MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825
SHA3-384 hash: 5b2852a6d298fe4e7ee73503d5514ba7159c59fba2de42284886f6868318fb2f8bc1708c107ec6b46806916a0f5d6b57
SHA1 hash: e4dfc68a402511001becd734d9770594dd46e6d6
MD5 hash: ab1c9671363de2f564b53919758d36ed
humanhash: music-california-montana-double
File name:file
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:275'968 bytes
First seen:2023-12-05 14:22:35 UTC
Last seen:2023-12-05 16:19:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2a86f67338210064828993e7f36870 (3 x Smoke Loader, 2 x RiseProStealer, 1 x Stealc)
ssdeep 3072:uvFDUsVh4KCGxgEqrubebVHyJVrQszgPRfA0cv2AH/m43BA8eDWt7Oj2d:eFY8cGaEqSbUV4VmRNjaBLeqk
TLSH T1D1449D12B2929475E15206719E6DC6F57A2ABC714F706EDF339C2B2F0E702E1CA71326
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0000282060602400 (1 x RecordBreaker)
Reporter andretavare5
Tags:exe recordbreaker


Avatar
andretavare5
Sample downloaded from https://medfioytrkdkcodlskeej.net/987123.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
374
Origin country :
US US
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-12-05 14:23:59 UTC
Tags:
loader smoke smokeloader sinkhole stealer redline
Link:
https://app.any.run/tasks/0331d28d-8a46-4a15-a2d8-93b1f59c3b51

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/462638/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.7046.15310.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Creating a file in the %temp% directory
Launching a process
Sending an HTTP GET request
Creating a process from a recently created file
Creating a file
Searching for synchronization primitives
Creating a window
Launching the process to interact with network services
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control lolbin packed
Link:
https://www.filescan.io/uploads/656f32493636548f373b8613/reports/1ef884d2-6d5f-4e53-a689-4c77fa9f6cc0/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0f1dba4-7b70-46ad-9239-7da436fde6b5
Result
Threat name:
Raccoon Stealer v2, RedLine, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1353981
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files with a suspicious file extension
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Raccoon Stealer v2
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1353981 Sample: file.exe Startdate: 05/12/2023 Architecture: WINDOWS Score: 100 89 stualialuyastrelia.net 2->89 91 onualituyrs.org 2->91 93 5 other IPs or domains 2->93 127 Snort IDS alert for network traffic 2->127 129 Found malware configuration 2->129 131 Malicious sample detected (through community Yara rule) 2->131 133 11 other signatures 2->133 11 file.exe 2->11         started        14 buhbjgi 2->14         started        signatures3 process4 signatures5 167 Detected unpacking (changes PE section rights) 11->167 169 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 11->169 171 Maps a DLL or memory area into another process 11->171 16 explorer.exe 8 15 11->16 injected 173 Checks if the current machine is a virtual machine (disk enumeration) 14->173 175 Creates a thread in another existing process (thread injection) 14->175 process6 dnsIp7 83 stualialuyastrelia.net 91.215.85.17, 49738, 49744, 80 PINDC-ASRU Russian Federation 16->83 85 liuliuoumumy.org 34.143.166.163, 49736, 49737, 80 ATGS-MMD-ASUS United States 16->85 87 2 other IPs or domains 16->87 61 C:\Users\user\AppData\Roaming\buhbjgi, PE32 16->61 dropped 63 C:\Users\user\AppData\Local\Temp\94B7.exe, PE32 16->63 dropped 65 C:\Users\user\AppData\Local\Temp\8F76.exe, PE32 16->65 dropped 67 4 other malicious files 16->67 dropped 103 System process connects to network (likely due to code injection or exploit) 16->103 105 Benign windows process drops PE files 16->105 107 Injects code into the Windows Explorer (explorer.exe) 16->107 109 3 other signatures 16->109 21 7CC7.exe 32 16->21         started        26 8F76.exe 16->26         started        28 94B7.exe 16->28         started        30 5 other processes 16->30 file8 signatures9 process10 dnsIp11 95 193.233.132.30, 49739, 80 FREE-NET-ASFREEnetEU Russian Federation 21->95 73 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 21->73 dropped 75 C:\Users\user\AppData\LocalLow\softokn3.dll, PE32 21->75 dropped 77 C:\Users\user\AppData\LocalLow\nss3.dll, PE32 21->77 dropped 81 4 other files (2 malicious) 21->81 dropped 143 Antivirus detection for dropped file 21->143 145 Multi AV Scanner detection for dropped file 21->145 147 Detected unpacking (changes PE section rights) 21->147 161 6 other signatures 21->161 32 WerFault.exe 21->32         started        97 38.47.221.193, 34368, 49742 COGENT-174US United States 26->97 149 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->149 151 Query firmware table information (likely to detect VMs) 26->151 153 Tries to detect sandboxes and other dynamic analysis tools (window names) 26->153 163 5 other signatures 26->163 79 C:\Users\user\AppData\Local\...\Mandatory, PE32 28->79 dropped 34 cmd.exe 28->34         started        37 conhost.exe 28->37         started        99 107.173.58.91 NEXEONUS United States 30->99 155 System process connects to network (likely due to code injection or exploit) 30->155 157 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 30->157 159 Tries to steal Mail credentials (via file / registry access) 30->159 165 4 other signatures 30->165 39 AppLaunch.exe 4 30->39         started        42 regsvr32.exe 30->42         started        44 WerFault.exe 30->44         started        file12 signatures13 process14 dnsIp15 111 Uses ping.exe to sleep 34->111 113 Drops PE files with a suspicious file extension 34->113 115 Uses ping.exe to check the status of other devices and networks 34->115 46 cmd.exe 34->46         started        49 conhost.exe 34->49         started        101 193.233.132.48, 24324, 49740 FREE-NET-ASFREEnetEU Russian Federation 39->101 117 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 39->117 119 Found many strings related to Crypto-Wallets (likely being stolen) 39->119 121 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 39->121 123 Tries to steal Crypto Currency Wallets 39->123 125 Tries to detect sandboxes / dynamic malware analysis system (file name check) 42->125 signatures16 process17 signatures18 177 Uses ping.exe to sleep 46->177 51 Imported.pif 46->51         started        55 cmd.exe 46->55         started        57 tasklist.exe 46->57         started        59 6 other processes 46->59 process19 file20 69 C:\Users\user\AppData\Local\Temp\...\jsc.exe, PE32 51->69 dropped 135 Found API chain indicative of debugger detection 51->135 137 Found API chain indicative of sandbox detection 51->137 139 Writes to foreign memory regions 51->139 141 2 other signatures 51->141 71 C:\Users\user\AppData\Local\...\Imported.pif, PE32 55->71 dropped signatures21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2023-12-05 15:40:07 UTC
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ksi2kolgizxic6hsjcdtmurvbjobzeji4zdtf6cx6qrhps7v3asq._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader botnet:redtest backdoor collection discovery evasion infostealer spyware stealer themida trojan
Link:
https://tria.ge/reports/231205-rp47msbh68/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Checks SCSI registry key(s)
Enumerates processes with tasklist
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Raccoon
Raccoon Stealer V2 payload
RedLine
RedLine payload
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
107.173.58.91:32870
Unpacked files
SH256 hash:
02595341e692dda7815655fcba7d8b1de7da65e9995f6e2e4f7d924fcdf4315e
MD5 hash:
aa3af618117a14c8f7df7893deaa0eda
SHA1 hash:
f9a903395555d7cabd4fef3b89c0f76c130d4b76
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/3b37eac1-ec60-4b8b-a09f-5671e4e02800/
Parent samples :
806345cafc7b457a4db43eb7872e1366cada2f75eba357874498368d22591b1a
f787d409487f3708c014ad8ab5165251b7ac2d621afa2d2ec54c8477e67fca3e
26b6fb3571fb7d2929cecf0c63324aa220a50326bd554b0901aedbf48387b836
b94fbe4609f164fb43bcf2a48b07b1306d8444e78b35791a5bfafa79bad53472
f1e65ef292a881bcd0b8bb82bc9f386cf78195ad04a4c139b55f359a5aa1f0c5
6a6aeffae09bf99332b3641d39606ebc0d6ae27d4502df6fa3cfe93ce7e3736e
7996f8f34d450d0cd8c7c35b78de3ea6dbd8932ae56bc05f30ad030622cd3fad
a5e88d8ca5b1b3b3ed3bf107256ab57c03fef11df6c45e521e8d11cc6303c3e2
100006c7008d8f1657a8d7a816d6016e78fd0fc356306076eb27868682fe5ecf
07f89446252c48823231a8ba971800b0c416ed560bf00acc49293b0398f1c80f
d1f5fc183f814979d2e6aa2b83f932d65130ad3cab1bb08cda380df4d3af6619
c5cdd5442277cadf2c11aa3122a70608c24db1a457b79923d8bf208b8d63e826
e9142e3ca7865f56e7d0c881b8eab627d77d9e08102191f1e55fd074a7e44fc8
e60b8aa1551b9d900309c6a3bf3aa5cca96d2acf7396275e16cdb1c1fb6424dd
e8c8f0f30d0c0dbf2f8e67af2b85af90d2b138cfa209563211da19a2198e6221
bfbe3ca0d3dfdd0aa492c5a4f4ffbbcbb26b6f479a39e8e7cdbe3baaf6ea8ee9
43e4cccd962e208d35f34cd66407b389d52e8a93aa26640ad5d5409324af609d
cf8b1ddff6bc1aff65d7f60085d319decd664c3ff08256b7374e6b05623a85ab
37289535eed6cb33940cd5dadc30f91f714715719ae3eff7389011ab19fb9236
9433d8bcd384d4edcba32be5f364651b2cba2e93b7f537796ffcca05f84df6ed
cf20f1cf3128d1631388119114759f37adf8cafb11768ca66d347b97f37d067c
78bede7e2f8b8963a2d6cca0f3c75fdc4258d23c14a0930f7ab761ac80f03f28
c1930afeb2ef2eabd75fe5b705f54dd68dfb02e1a25476ea7534bd69a567bcb4
89f95125147099a904d27ea26b3cb99c98f6d289bd6d6fc437d1e9c68fe65274
507eaaa1d406b7ab2ee84f49bda87ebca9599192e0d2fd0a13cffe9aa33d7d37
c4e2d88423ccf3deb091466181ecec99da2b65411afd07604216dac7d8dcc939
c3020144db0b8288140b7f88d5909851b1aacaa3df70f8f3f2c81cae76fd7e85
c1f292d936e613e673ff96354e9f0a1e984a02996e6d92ac18291f6f310c739a
201fb0901529270bdf56cb9d8d432a28040be664d49e041f4a7c88b8ec5150b6
db6c3d5619712d295ae87fed995f0a836b4aed4f594a7005a5eed920ed1089bb
2193ba5c30016e0a36b4278a5d2ef1aec933744718a50f8480a73a03093ee102
46ac0ab158fc001e4dca1d72667b8302470526bb97c0832f7ce2c0814943a667
7d4bdb99d48ddde6edd2a63ec5730aff430b1106b544dc4d0f69e25f601d0a4a
7d28009f24871d841eb41fe272d816b4f8e386d4d2a10922a6ba3ebbbc1cbf00
b7a8713e933eef0ae8bac227b4fae10c764f4cfae76052423ed818b7cb464d51
4fde35f203cdacb88a85df5622b3b0b4e3f572c616b124c007d6158534d36896
14fbf0fe77ba40524b71257012c5175320c5b19c8e1871b03ed0cf24994efeb2
26293e0ccda76f0ee39b65e7d3538b0df51e1eec2680be05bfe566f94e8cc564
4d4723d82252a443ebf20abf584bd7de2e22cedb6df8db2e02dc8ac64b87750b
d8b98a3b130f9e76ab6b372ee23d6bec4bd4d0e2c151d7df7d4f764a9453ce0e
391706a40cfac92148b8c21f3eeb07101dbe69a931d2b821e2eb77dbe9bb0c07
553230c06bf11ece9093e3aa7ca6b414b84a21e1a35120d3d7c2f9c780d9c5ae
ecacf78ad957224fcc0afbd65118f2b5e8e2eda5daef0e072eef35e5f12a43b3
4bba6cbaca8ad2de49841dc47704f6718f6818a9ae8bfc9eee4cd47205204772
1ccc9eb2cbf1784e6156b1dc0cf3ba7537eef4edf3feb72c3ddeac4e0f7bf5e8
c26d93b2dc38db64e470819c16d1432046989f1e6fd4cdadfe319536333d7195
9a58eecbe942138dbbe3015ff7cb1ca7a96382066c93183beb3dff94f3364378
e0acdf39571276a73c0a78399bc7fe18d549b3362d686bd6c0c18792e2e8f2d8
054fd3a5c21d38ddc7bda158a64e6e9046133f4e1baec829de540be4f72eafe6
68b3b6cdf9c8ca33f283db0b99ccc1387eca04bb4d8367ba16957cec6202d005
7f00025d8192a139535964c7cefbfeea180f03220d83f2fda1c338be7041773c
669d402216f388239a2c9a5556fa2ad6a4947596564c059a5fa82fa2e5ae5b8a
28533fbb167059524fb63906320201575b19fa3674f03b558a42e18fd7523f3a
4b71e56a2b219fdfa1045849698da53c58ba5b8d3c1404d9978bf88108e72a02
da4c6382932c431a9007bc8941d4bd3a13ce940d6559a07fe80ad3bafe95f0a7
a9a883582cb7a18b20c2bee6c896342ddb37a8241fc670b75e089ab5eb4b1932
88fd8c89e8f2bd228af674554c50eed52e65a1a4e0a06f9cf651306da4b554a3
0f1ddee9317c0ce55c0cda6d0ed1a4d687a6ce9c44d7894109f3628144747582
ec2362e8621593898b0bf217dd680288262c6dae95c1d843df4818bd0e445e56
3b73c4da6f2bda6ebc26552afccbfd8c097a5a3195fd2593840d9ea7712b7120
b94c6534438e02602db65e7c62be3a8bc62659dcd4977c3a15183ab5fc8ef5b6
9f6b062d11dfeb51158b9d133c7ad76051dfef5678f6af292e87dd464c6aa50f
e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5
5c88a340b3b0502c9777fe6159f01d66875341dc739e23a56a21ee18479890f2
a73ee8f46c7caf4da7ea6a92dc0a11d58757a83e1b5b9c3723b49690fc238271
4af0dfb2b7b778872e0ae9d40c7347c8ec3a4dccbf34590107dd449e6f4eef15
247eb6cc11d0a92ac985fb99c19dcfe4779878f4989764b8ced06727820ff57c
0ef76ecabac1c81d4e2ed32c6fd30d846214f385a51523b4b78f105d9eb406a3
0004d851f92bfea425f064b898e7668d84a26e12954785ce0ec3b62ff2e34d46
914f1d5465e5201dc2a565458ac9744aae002a6c7ec55a77384b0b8aac97da40
467166f371775ca6da6a789326f6fc4501f4f76f4311fabd5e509574f13cf48d
afbd517384e9adfd9bce9acc13e9096ba0e5212a64c50a0b0e02b542d67eceeb
2b78d384474b9b3193d37612866def097e37491bfd991e0687b943ca135b18f7
b21c893c9c411160bf2bfbd1df40247757aec2d9606a9a4e873ebd36ca2b7904
76ab9dacb5fbbce3d4021b4d46622d96d0599af96440989a61c8fe555a3cac33
c7a4a9461d04291e8efee8c52ed3b2897b61e2fc3a639296c60afc307db7a821
ad9036440334fca8e65a7c04a8a8a0f5ca8f9cac902885bf37e1fa04853b7ca1
3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0
cf17ba3233bc2dab9db27c1c73682990e0403054fad2a4ba39316d66c53bb406
89797297ce145c9bb7885fbe2d79a482829e1d789e3112f785f6cc6348134db8
354d0f574652207b4b396e45effb35d4948819b926b9f968fa713e03726f08e1
406d3c343fac7b3b70790be2ee88c7aef0a43c0aa71ee9e501847bb58df9caa3
52f9858d267de6bd71707c083cd0e53543b1847c194314009f1e6ea3bcd84c94
8d423d5ee4bc84fc088ff35fda7656d0385d35fe1fd6c3cc575c9699cfbb7e62
deab8c00637f509afc29190c048623d50e0aa2aa284ce1706b18c349ce157514
38120bdca03441433ad915b13323b20ac07059e50af9fd909d31a33f1d8396b2
6f2bbd35accc8785877395e1967538459f5e96999c7ad17b96e5208b6e768c63
2555138d315fe335a9cc77ad2c3f8b0bbd0e066f38db784774b26ba2537a0900
3626f9260d12f7a2c8b5fdd51e136d36c3085e98fd434f13881257e7b1fd2c03
670fb89cbe546e0fb5a2a5ac46eb1aeabe67d82d6035356feee872e7f4b3736d
dd006c90365637e902e928053efe8113474b928abca336497762ca580b14476b
0f761b7d8b1e22f677afae3f0f3dc7413388613694ed62fddca1855334967b4f
d3dbd4a3bca68c48f382dfecb9dd236b03466b7363cba5f34f968a04f88a79be
57fef45f7320d4fb2de317c75437049769963870662222ed9d9416567cb2db29
999cef5e52498f553c0fa9902608b29a85891d04f300854c7784cf7476e7a785
05edab6c2f869a8e4e8262fa0d144734f43c3b8eeb002c0711c3d6643ea4838e
56a41c337b7fd51f7d81f3b7506bb0ded033decfbfbdf2f69259ccff0fd547ca
a8aa91182c9febb8db8f1758c1c796b73cfd6cf8494e809cd35d7fee2276802c
b6961297c26ff9d5304389fd95d1df276cc6d81e1ab52c61f99ef8046d969ae1
779a53aa3f90186b419cce157caefc492dd5c07072bbc9560992845fbeb34c64
d069d2f8f290c5b72ea64c297bd1257890066924f241dddbf45e66d6d15fb449
9b407a1c2e907f13de6f840233ad1d2d181b835459ff028cb3fcc55ca09bc67c
3c0c51d03ba888e6faa5d930d0a747e21901af69250bc137b55e85c6e1d0d963
2159e74387f64f331878f65c567cc7e96db51032407d24493e2d24eb382ac7a3
283404e8dcf4c669db0e33c6d0b84b2eadd3f5f20248cb2988db0876179c6c30
d3ff42e30d8fab9324a80f08e50445a1fcf72fa2cfe410043785bf4ff4c637ae
5b2c28ad2dc32ebcc258e97e9b23f7474d9f024fb4dfb351961f6ab4d001e763
1d1df8181d25fcd601c8e00af76781c48ac50eac2db8bd93a97347f5989968b5
4221d658c267fef9779efc15f876e619fc8c4f425dccf1f46f9366129ea44a8c
56d7ea0d33d4eb5beeada0c4abb2ecaf72b69c9523674d994442906757533bc9
2cd2cc5609538c8987800cead464895717c5e009dd4cd33a19ad9499a4863d9d
8208f19a8329dff98ff72b46b91d53ffe15dc8e9346106c07f5912adcb2d9679
8d026e105c692f561ba23017a5cc3c0f4d3487776e701c27d7ea79cbc46d334e
50c1d754d7837fc0b4085436b80acb900a1b3a35d3f3fa27420b8aa9a4a9f29d
b7eb900f9032ed11819e0cbb73d75a340ae4f42094c3013667507233899dfd10
a8c72317499ea9b749580c38384047b9a886f09b6c2c5a47626db5cf610846d3
18f8dce009bea0ef30d1c6c2604ebc14ec241387d3582d1686d5684f32abfdde
84999df2cadba8aa6b06ef29066c3986e052518551499ba5bf2f9864ecf4cb9a
17349c108055b65bfd3906401afed36416b5b9351db8e909d3ed7275a3f9169f
92a47af44876bf1af3b65172e5c8f4b8e47b3e9aec90631ae4b0cd43a33e675d
e6c757449536eefcf5903526df6e6dafa4e352fb7b55024ef005a51f7c853e86
4499042716f191375f2ab9259bdda83b11640b590c241e7700f79daf45657cbc
d2667ebba32efa519eec816fac01b3be538c57c2830a23eb8e43bca561e091d7
e85172898e1439bc95876cd84f60ac685bd13ee9de2bda81f497807e7f7822b3
bf44b97a7d80f4d13468715df8527afbc3dbc41728d1a6223fa00fb573c395ef
a87ecbfbfb57f554a3dbd8f62b38ceb258205aebc32f3a97aef2fc2520393c7e
d5032cb2bc27875a36fb41fc5737ca0c679b5d7003a162f25ff6ba4ca57614fc
4ca03271d581294aa258c1ec3a84028470ecf87f5e9be222fc839e0f85bc4818
c50c7caece0e3f17500d2f69f5acfff1d45b1f3319ad17462f0df8e7793a2567
805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e
4a7ee8c3c62c87ed0a8c008b67223da88f759a91065f50fa2266fcc20f7ea793
5d403d35df35920df658161a12b8f1af0a8b1ae9329e5b85b82657e8bb970637
fe3fe76ac852603106cf5f7b967808db8f92beadbff1302c14f336e7bc145b9b
9f63a88e8ed926a18f4bb89dfcb59fdfc7b57d887b1e2099113948a9bb90795f
ee01f36cc648032ec0cb38d8555bccd0d9d50103101938bb97396f284e231e5a
3527cfdc23a8ca795809da61e9653772955d9ede01ca8e0ba2176451a8c84df7
9254fdd849c2461cd245c2835d89e11439f03e8043162a40f0885ff4daa3837f
e75b58075d267d0a6e99f8c1b712ed84f7511570de67042e805ccbfe68abca43
eed040d5fba2271fe1ce5afda26ee4812b38660b2215ae16d9a94c4c6e02f6bf
32dabc2870dfd083f634dd632a0d62055c31162b7b5506612913579a1152c6eb
fafdd927e290600655f23742df6487103ebdfb8ab2038d7a6f2d12db2483710b
5bff8bb85db7c5ea30cd9f8e71afa589fb4383aa831e9982321173938488fc1f
3e5eb972ada7e1c4acc89eea60f1bf0042fa753c144f810ca458f42ee8878572
f966c3f9cbad2cc07002c5c23b898ecd0d3ba62e5471017781d2bf8d18dd329c
3fb4ba5109a74f7180d4f6219dfd40d8a7dd04ddc8017dcf3a2eee59082f0b59
a739fdaf9432a46f74c6e215dcc2e2c6c3de0dea1e9aa5a0e76cd6b47aca7c31
0c76aac50ec94b20877a3483eda8b1135fd9c5e9a221d71cbcc75a170ee696a9
539f99fb1e68a82bc04d5b7e27d37e6ea420e1a6c8cd03b5d2a6943dfde2c8da
013ae26e9f6534bcd3a7473274abc017b4acb752079df16c41537adbcca45114
dc0ba06fd4c66426d51e8dbe8f024cbaabac21d6562caa3eb13b550bbd79dcad
09f72f18c0c70401b82ed7295831c1bf26e158b1b0288f6ed871d7283133d0f0
5447ba93991d4360f85ed4c00e5d366f4c0d97f2a95b9e8b322e72d47c9035dc
2aa1983e8bebb5c132a6c844c690b9c2fce8c6a3a3022983984c96192e541f81
606b61117caf6ba19d8a217f9e63f1cf15272d9b3b4f1bb2a652c9ae00e9e9e7
def7bcf219ccc1fb0eae87ac50e0802e46ed56a0bf43138bd437153fe9731679
07508934046b4de416c0fdfc9de99185fe0e95b072ad918f824102c9b2d6aacf
bf16b6cc8fda26d87c4435d5bef9686898dc9fb151624792b4fb896c2759a431
6b62cc8586be6b35e6a189160b9176a71f20bca7b155b924ea6f753e0ad0add3
acf920c5cc47a590e24a405921086014efd26e1323a887f32cec3ee0c8740f68
411a2ddb97631bc79085aa0977edf8082fdc3431686fcf58d6b61af704780952
71e776f4e570df9e67a31c56edb77eab4742c94a70ba0a938a5ba2f6319476ad
b936f7c366cf4b5669332436dc82648038d898d56d3042b531a5f15b0e4f4c0d
aeeee9f51ceec4a95e1e70dbb3c3c15df09a5408b29a5802ac1b65e2cd69210e
80015dfd0fb4f0867daa13132c1ac922cc94c850853b874bae77e42c5248a7ee
27c5bd50c47c47f3c4b0ccd545a51dc2e79e9ec4db7ee28964a8308cee669ff4
af23a89d115618b4c6bb4dc7ba63ec03e2907e7fb89c66edcc95577033063430
7990c0afc6694f3ea41d8356ec113152b66ebc0e3be8fc58a594e663fa690883
fff8f708ab3b88d6a1335357c7422c1def9e76fe2a591b6bf890a576d75bd84e
90130a823094427d2c4ba180fbad4bfe2f6221916a5e13d506d6938823f130fd
fbc1570fbd324836f10a5465dbb45516ef9941422489506cb631ea5a989e7b0b
f2ab1aa34d0f6fc9cd8f6db413e96e7fecb62a63738db603fb41c1bda722d5fb
95396f2372d133a24cb6a06307c865f37441cb985baa6ce021387ac7b0a2de91
47abb3bb4a3141078898a6bee161b07764856979ca662986a7f1c124dd1656f9
c0f406f22d89749d5d275f1ad876fd505607b32ccaf2d39a9690318cdc12e134
fe020db722c03ae5df83ddac43f3f4b40f5c351d59000a9352f9615380567aa9
9bf59a4af9b2e41ecbd695a53fa9391c974bb7e775f23d3eae96bdbadfd40e82
4f55a7e7d52bbdf98d294c0b8ab1b10d04f67d34bddf930fe8881a31c152ce8d
4b7585c7ed8fee18501dd661eec5cff051bc7078c84181b8e0115ce14cfab7e4
9443898a12274ecffcc27e9aa9a1181734cf6c588c07a6d7bcdab44d21eabe82
b135504480a767594d70045824f7eef392a71cc374883f30172aac744a36f4be
e0f684491db67fd2de073942b9a8e0b3cf555fba4aa90cdf777df15bf88588de
a13caddc82b57a5add7f98583c912cf676504a549c5a0b7dc2dd02d9c4cb3f30
c25d4b735cc97ae902bf3699eaff4cd99e405da72467769ffb004d1a98ba8eaa
1f41d3a0527983c765effac94ad197d4ae778ba512e2e66edd29c43251c6f80e
fb3efd61057bc50d948e725db07523ae9d1d7031225c68b2780f45e7facc8bb3
110fcaa965db95c77489dc33288a0453ad9dc4048168606eb278d0f89e007cda
df54f384e18b3f92dd798cbc1437823f868d15282a549a5133e09851c2e198e4
af0128a11a55602a28195de3ea2bd7d2dda5447861e657588f067e677bef33b6
2b292bd0256be0c2c32c7b791e7e96164ea47cff62748a7604f4b4f7ecf72865
0c8ec4763bb3aca751f13278b756cd13036a69f36d585030fa89716cc2b63cdf
e5d336e8059457bde936629879876955f8f1dcbaab3d96c7b7a9dfc9d8ef048c
eda1b61399b5eb51c1d39c093cc39f4587c59751ac8eab6fc8d57d2f58d7229f
ef74c4c21db18cfae6ef7ec3761c074d433f81945835613f0772c87c077cb137
799f36b6ec3ececf02592ac9fc0a2ac29a6cf0b0b3a11aaeb0df4b5245c9809b
03a83e440c0d1d8f9390f8edf180c54aa4111a39c2b00a05650e4d47e613c754
b3aecef8a41079cd752346286c9121a6d103126d1e634c625b8a4a6fdff15090
4c9e023a3df13dc1985827b37b8b03b1a6a3703b9c7933a1262e60d94dca05d3
218f108322b3fbecc63c9c63a3fd34ff8ff17bc60156ee7e76e929f49e0732e1
a846a9156fb4e966bcb73321248885c5da813749f7b7eea9afda1bfb3a03d2d3
6aca6f303788c2fac33351f3ee7298e6fc873d747bf0633c041863ebeebb56bd
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5d
6f3f9558f25679fdd6390552cda47ccf1f4e1957e4f2292926a3b1b7105e24ca
a12f4248bad65ffb4d5aef03bbce2954564385b46831972c27a184b7b6f01fab
8a74855bc1462685f3f4b012621e613075a65faf8e4b1a40c5a95e870b710a56
ea6901b382c4b8202e64b3a588846f936cd3c500057e535fc1ed9d0a5a305540
8a471d8d511a2138ebcb6ef1caa7516b0fed2acb1d95c3345a8a06d30652e496
e6fa2f50df9523e2f5e6da0e4afef99b83d54b74e729e5cdffea119288527b0d
5cae32229070c310e8bf979827c6e2ebe37fabfda2f29f83c2d05d81f4e569a1
bcdf1c2e9b7f489d189a8245706c64c9b82b2eb1f61fbd0d35f29f1f5f32d45a
0edbf15340660b057a878c9885d6387022e0aef1b2cb1cdcaf82058c25ec6ace
49f65e66b00f5178744bb3e3c1f7572aad43485fbbf6b4a3f729e58bf86c8d74
c08eee0129f5e63f5226ff413a14a442cd931290cfcac55e2192a704eff63562
190a3b8cb53cc76a04666d9453d30527902b0ea67d56d6462d9732b91768d106
a647595e7316d00d459c41191fc8169ce5a3cfa357d5a9651b6f870d6e06f175
aae3c6355f071ad180886c69ba02ed8eeb21c4a7731dfd06f8da3f02aa3c89d0
a60d986514630be39bd894ab0319a0ed1ace621183f7b3042b3013d4135fd953
d31fde4191e4a075ab9bf9d6c7fac997b463192e37ec19d135f618ee7cf33d97
aacaf9a39996809c3a1fbbb7928b1a959a80df73d21de01a1e2f4bd0b5163d3d
c3b1ce881dbdfa450266319ca0a71416c937ee66898cce14afbb2589a7d692bf
8859e08fc4a08676c19d7be232972eabf9a90c280bc85c1b19c91ba23d451503
fa7941fdd6c898bdcad1116c26a2cf7ed4ffce1cb19c6eed9aa7eed0fd45439d
75fe58076ae561f8601426c9fe0c9eecec159af0a70ec231c74a4280c6065cd0
6e238d25fbfbd2fbb1a90b59a8c9084d271b919da00ae952cc00752c1a930e3d
15915744ed40b4541346fa97023e664dec539bcfa84dbf2413247e9c5225ae38
2214692203acd46a0d83efedfd360706eb0ecdf0ca824ac394d222f9da378bc9
9aeb28e4d246415a276cb32260349d6308d9ce882a1bd09aa460ec54bbb9c655
3858383e03ee59f69562cd229c2f02ef94c202bb75917d623c09dfb14222854d
ee337045aeee7e4f46819e7b127c1f883ce6532d39d4f0f395493d21d14fc634
bd6716f524d919432bce16044797291c562b70d40e14e5bc5bd81eacaa6bc885
6849b66f6be795fe981e71cb5815c7df65219d9d2eca1ac0feab7dd1a175433d
abbc7a5acba146ed9c9d62c148579d3690ef5571a42cd5bdc7771af67c872f36
1a62023a297d4ba4da312fc824fea8c70178ad249f6b71ded8fdd737c75ff43c
ec5b549cd8aa70833f208da19b9f91e265417b5b6fdb30ea28c7c994158e6a4f
6c5e26da0e6f6f695a45b50069d024595031e0c9d29f3fa585561ca4c5893ee4
c5c15f1a99468b07285f637777c30b034081c5475a0b255d8b8e72c7d08caf34
be46242efa2a9ad3b33005c9a1bb90197953c22c9799a9bffb9478f4e7c9af1f
e805e010ed08270484c8107666d61b61256efa91f4756eec8f0208ab4f4d6ccd
ebd83827518516b73d7d02933c5a17e2afb3db4439669a570d1dfd4b47218128
1ba7233dbb067286a85d2d0764ea7fbbe041d4629d6055289f230cfa9c7ad35c
f43cd9aed1b8fa7202418b692c3e0713bbee1ee181bcad36e7382276c79dca47
9fc2b5828400d8e69b6525bf842bf2552a8d4528df701e41eac20cf1afa15285
6c3869ec8c25cec454209f60a18b5a5cae2407708ecebc7f6be2734986dc499b
80ccc5b03bcbf6f96f5a68989000dd9697800a42667c6d4ca3052fc3974e615d
bcff96cceed296bb388af3cefb54788ef28cbfef49d463fedc4e7f810cf96f22
37f806898c3a9cad02a28645644f22e22b761e72a82758881b495691dd4d0097
fbe00fe83e5a5a10248597211348b06723f181ff37b70429b424addcc9e6ffab
82d763b6cd97ca240a291c90b8de517232b92cbbe5b593549a61547a30eebf19
5c5c3c81f61e420975ce5e08dcc44227929822a4336fcc90c750f6b348bba663
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823
108d44e6319c02502d93d685c8c63c8c8f773921ab2b3495d8c09009d0e86eef
0c9a78a76b94e4b746c60b0546f3eaf3a6a33b99ea6e1c73c0242233df36f97f
03d1ee7b285ca1d03b89d8899c1b966fad747341dce8a46f1efb803718905279
27f4f0e84a00e66fc9146d76fb7df56805b44a55c0186eb61230332f69c3d687
64dd2b0b471dcec3c1868a9d6a0d27eee4f0257d32654b32223033390e17f645
30e38b7039f1fc2070c81c2544ba1169d91074e59924b74e3aa7caec4d081073
0ea5e6ef38e8566aec0be2a53048e65915842636b9bdce6209f5473920ed417f
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57
6f418d1bb71dc74d174f5fec3d04492d3f09e61dc4cd4f9e361ad3edb8af9d13
33a302ebe74f765303611a1247aace6d7a4fd6f6251d5ad8e30c3288fe38e1d8
ae8ce1b7f5ca5b5fdfdc1ce20dda05107ad1c2970f3f7e4dc55a831be91f07f7
e525d80bf0d9fd8238ce5f584b1778f5d61a47484cf5f979b78649fba635c12c
adf65d66d76d4ccf8c548133de94f970cb441150f487d8753939922bf18c341c
9d09e2c2e8d21e46ab105ca0a93f22328c5a3422728789701e0b59bdae5d9c18
5f2bd04f08f1d65836027822cd62d6de03f12be94e89c7cc3c40fbbab44191f2
20fb25cdc691c31b5b59ec871960363fedb13d10e2f0d274eecb3951811b7fe8
6d70e54432ffd9004cf536ffae1093445c5785c249f6f708683d4cf2f4ce77ed
f4b8b3072c3d3144e7205bbe45f0fe5a0c5094a6de84984d02adc3987af83423
ecfd9ee835a64af9dc0dfc224920fdc0711e5a31306f3b3b4100e79ae92e0473
b3d4eabec6867cb930e7acffb8597b55292577c2eb7cdd0845d6ee0460aa5b4a
50be7cca2e6c370999e0fab17ce4d92cad6bf2c486b06109c6dabcdddca3c7c3
6049a46de000ed459f45100d6c3011d340079e3caf5fb8db685cd6ac8df8b577
04e6676c67f2d906fbd5bd21bb266f4b6d61d74ada069516a466d30adabc5b49
4d0960d3d240b1271688813825c44a046ebd92fd29ecb4dd5ac112d6a5adb0d7
2dd2b9077c3a54871007f04de5e91f3f6d12fca99afc77ced44da7aa3268ba26
68ed5efeeb06a3b18cfbea480207eabeef0cea3bf09cf2d5fb2f343c38d2ec61
9892fea1e7af5e2a3f88fe0f3a8aeb031b3f1374574cb8d0079b03b0bf3f299f
38850ebcfa36fdfe0041b5bf0b37b28b0a94b828e2107cb947bbd74df3731fab
f181f1f714f074ec2058d5d2d282316834e2150006ad2e27fed1e7ffc47ed753
7de6361871c145ff5c33f189fcf5ac612066df73af7d0c8cd1f59cbe1ffdec75
8d2e1b76ab14be9d7df6935a19f62f22d2cadce9c6c55b87b39cb0fb8ddee0a0
806d2bc20d7e24a2de857235b9669d34b1a8444c8c4c7465e215326bbf341b01
2814c36f0f107c3f18bb3c3fd3fa30623d25f445b15d110d1a06cddc00a3dec5
fd932cc727c801502c3c3250efa825a5bec52aa3343ce2d249c914c27288f425
c49ea7a66f5a817b2feaf9fc3665670202732e46dc56f76f90de8781644b40af
5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825
c34b73230e2f9a02dfb4eb95e435f3b2de2d3a3ba4be2f66afd9f93053f50f28
3ff3a06b10b6158ac51d74487dd5c108dc113b3e7a2bb598e37c2d02e37f4631
d2b9a91d4fde0082cc1e99e6020019fa709d6862d58ab42722a441c0e16fde9a
589e3156476632157530813ae5e67f8b210152f9399201330ecea6a0fc01599d
da30ca4c4e4a7891fe3a038c26ddb68e35bdb71ff5651bb8f1087f116ad834da
a5642614a3c611cc8441c535860ea4159e514b2ff47aafe98847e721f034b083
54d47e722a046f32bbe88bbae4896282f71110917fa70a5159f6ef47e9d8fa04
bb0e2dd85809cb43a28e70287f9cbd0d6bb1d756426fc767022e01976c18c556
862a4c1a0f2800814fac172de8a78df12def4ea1555a7d2a79d8a77bed482097
fafefb18817d8b4def57cebf45037ce5c5f563fd0b4803c2551b9888545614f1
cb654870e051cfb8b46dbce1018acb5039da9b95fc46a0babb61e191d9fecb53
6af109fc0adbf4d70eb2559299b138f2ff0987bc441b80ea1f18879540ac4638
6452b7d58e29ccc3af5a938812e4759857cf3bf423533cb9316d6320d6417f28
4050dfeb91a1e1f46d6f7b4e19e8fcdb82da14ae101e78717d805bd574dec9a0
647335bc8148904e899b042b78b713852eab397d50fadc6218d04b5b1c00ba64
4906f727709a2acc63c9a01b56a66e1a29703e259d26f8dbde9b40426385c0bc
d5cf0b3376ab6526ef33bba7808886123b6ea6ca412b9973c0e5b5a6538f3379
17111294591d1735f172f1ca46deb487ad11e88f1081812a563312c1d74e5174
a54ef7e65b902e85a194b8d634e22514117144b2512c6274974fce37f3600149
be3d9e154db822eb33fd03266dcbbd5187d8bbcba89ead06e6bdac27db954b86
92319a40080f0d0b88b0e1bdb88620079c42e788eb496980e73716093e20e3c4
8d5e6656e31f4ecb52d148ff5dede48c1a618369fe3fe91e86385f756859cd90
c13653dc0ddb153ce4e10bec08fe5706a637eb0318cde61067d35173ff947f41
562ad6662c159d6d6eefc32ba3e290adabd83605ce2d2851ea760d8a0ae68f64
122a3a5bb1b45b815a8da7c81e72cc54157436eb3fe5847150b8db2eab0b3e58
6aaef95294b256622c66f08bc02ace179c5d0ddbcf17e6cc8363f93f84bba128
5ba336b8f81e2ca930a26a379d10929c718c50edd9720378580d91bc74e63ac6
d2abce52ee3ccdb88cb4b1762dc9c589143b34428d20a4fab583c384b1148b2c
756fe5afdacb1aca512fb2507fb849ad470cae8ec16a499135875c698e4ae776
6d89ca0406b305f0f368c528fbf19db4bb0515bb4368f36493d66560897157db
5d9a1b17900f2debcf5f4ffd3eeeec396d373ccc2c26f6d6e4f9ab429ea68968
fe3bc704fd5080fb0c60d4018ccaa2960aebf554b70e6b6f09c7fe03101e115e
e89b094c70697e1c6780b135cca34184ce1d58d9a80e11175f1f4131bbf5fbf3
bfac0be6a695dd6859a1a42c0b0b5ec599307a7861db14b746c343ad065bfc90
69ca858a2840e88685b4ba36d161a4dec20f946a28c2e64a0bb68493174c9151
7e0b66b62fae0419712284541b028b0b6796b9eb5e8bf53a9e8cd524816bbaad
008d8353dc2579a895d4943c9e09690b93c15df34c21477b7fa90aaeb2fb71ea
84da9f3e659fe1c42a9c5c5744d435ecfc34abc727bb70081f85447c464e10b2
c682032552ba72c1e51ba6dae34e26f7e00e7c142165c11870bb15435734e494
6b60390e5c1a0d0b4a7f5b8fbb46650042fbba08f56deed1b0616e42c92b1826
5ab47d1b15b5cf3b139443cad68290a347c09faad68bac50e5bbf66997b00607
8be6bf95b0faf13153d79974f9bee22107abffa51eae2d02bbf0b8e2c49485c1
c3b536ff860e68e9a0821b133a6858aa4f985c265a2619237396a0cde8e17b6f
16023232b2134dd03f546c94c9675d188c3b51cc8b8beff279f18524be3868da
862b82e5905b93951a9f312e55b9470dd7e8f178ef481b56e06150a94ebbcb85
46100b356f1382d88e9c7739791dc60b80e0570a00171ffc0223e82edcffa1e6
c34b82f35064fcb332322192e615bada1b2781b545552e654e80e972632ae9c6
a58e48ffbc29d8dd0a8d518e4665d478ce641aa60754c38b29634e9650135e75
cb06f831ee9395ed528e0e5a5b5cf72307c4b187e7328394c5953a05c518f4b3
ccc0d95df86312dd9a7bd1fb098dab9ad2ed2551dbd8de0a65a69cb5918c6fa7
302d7fd05e821680b9e819ae8d8bb3971b2e0a14a98364a8570b12ab8ecbc395
12852691149a91700efb0ce6babcab9fa8a7e5c89db0f72b5c16e732858be8af
f95b45f166111c26d59382d1f77d8c0767972c5c7c4c530f524b9ead49209802
5560c9e714db97f1dc3970b9a7f4dd416355428cf1e2683ba5a6e67ac6b1eae3
f695215df53192143d667c6c85379d1dde027cf3acb28bbd93813dfe5ad3f4ab
38d0497642677bb199f9724cc4c173bce0247540e5b2ea5c2a45f2855f58f45a
985cead0658efef2c45367595df24ac3a69c5b053fb79393668895a95dce3435
ec760203d8224d7f091c4aec2ce2cc48956a0b6ebf43244115b5022dec3af74c
223639303f4851935f44737381c968de5dfbd93d60d47b940a56b60b718ab557
b0817ea272e99ba53de05c4e6c4b4567acf3142cbc56acfbfd3a8b17bf0612a8
31128c705bc837c86e367318c64d1942894ba62fac4eda37f961406aebe4676f
07962afa3456e31a683847e0fac357a4c493033a0781664ba3a92e37f8a18240
1ff5c42f96786dc7226f9e4fc6f25f484f4d6b5a8641d8d477477cd950c51004
ff36a811ea97e0469f80a01137cd4e4d9b24df433db0f21dfdb7e6342fac538e
6f3261739f5fceb0712cdc57fd7c26a0ec3cd582e7e1828744596a18b0ec628e
fba12ce0cfb501650d68aa631324fe42d130f70051c4f6242804ff7e302b90ac
bc71bbf5c1e3f63952a645353ff41d9b6db1c631f9ed34ef54269b698fe3a992
8ff625c680939b5032d76bac9075a1c0a437b85dcd750f9b53098fa61a3733ec
0e7fdd38a178fa9bcb92d9141155b3a69ae7fae7395e51c37631cd4d93a3a49c
d5c0b52b8b4022cd7a5450cebae026e5992f4f9e6959fc7e13865bf55e092bf5
aab601c71cc06d2fb8a80bc4884640bcdcca0bd1787598afd1a82fa4de0200f7
fa15fc2db4846baa9558792f3758b38b686a0a933beb94e5e699c7e8c23da6f6
daf509b87e48e580e61942ee42b9b7c99f5eb09656f1f02c8bb25bdb862b4c42
f73356f929e4433ab8e4de72dd2066285b3db7cf3c556c8c651a1e9a7f6cf546
e193ea57d97c43c55d35817e1678a1f51d5f07f1895a4b8ad4ca7a1fab274d6b
13449ceaa1bb5bab56c9f6793cf0dc108aff743bf0996c75838874a1617d4e4c
a9a6fd53900ff9b7cfe5338a0eb12614db6313f34c0c08612b20c7ad0fcb5464
3278357bbc2d576bf42c0319a968ab9544590bfe99ebc3eac51849f54c154f86
ba67c24a22b57b646340c7355e30b1f9f837f472fdb3b701fc0ae10cbc176304
61d8d265f47495f62beee9a94d93553e2487327c25e4838ec4b8cbe2e2243781
08bf93d859767b6623b49312cdc8076b701d2147ce3d87e3a994734f0f1319a3
bad46fcc2c912fde112f0fa9b432c0a80a91e55337982b2ef2628680e0270551
02eb002f33af51183396e8406bc7518c01c4b2f3b326d227fef6bc7e3c8fd1a6
f518307808486c2718cd6b83e4e5f012e3531c8d352abd6d51b7311fcfa2c28c
f662b3ef913a9bfb62cb970e6f8f8e81ad75b21deaccffc01cbc1390f34e776e
138725f202fb8202fbe3a46e978fa69000428a59fa2a5fdcba1c374bdbe20aab
06c0877edf7076f1d18b6d6a0dfe5e1a28e909cfbfb5868c36f5e0c7b4ad6082
5c05c6d8f8cfc7679a1892c98cb096d3d74685fe9ac953a8f3e1455739e6d4b5
7157ecb7914f8782239cc0160a3cd6ff622e204651d957ac7846b4ad7e7d4343
d602b68c8e464486970359adc0b26fbbe6d2c297f00b3066840cfff53f1a03c1
9437071d8447354d24e4cc4caa965f36edfbff7522069fac6c632651662daca6
9af2dc9e4aff5eb9713f302f787b1f622f7f6056c0afeb3a635c4979fc86475f
4632afaaca26e69491829d3b0572f3428b4c1c6bbaa290f988c8ed9860973367
066305f97664bfc3d47579dc2703961658005b8006fe2a1a520c548d2c3f5eb5
6fe8ab034a34587aadbae158e721c37a120f1e4fe3a106d74182a18e2c4270c4
9e330c6bd0976028c8c3ea76445357f181ac1003a2c05fec354e630fe4e225f6
f9307b1c2231902df6670ed44331655d21e285d1c308a81fdb52174a186a9efa
8fca1f9021a9ced5f64038dfd78e59a5aa1250758d1455064a752fd142da4a14
c3b7fecabec97517f56a046dd5db5a4060471b5903d0fb9821705420c5d10707
d993da5b179af8c4c4a3a29ba72182f51e47311205c7830f9cca88ec71328240
7381e44bceb1a34fe308780ad1aca1bf5298ef5fcad8e3a1fde188755bcc333e
SH256 hash:
5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825
MD5 hash:
ab1c9671363de2f564b53919758d36ed
SHA1 hash:
e4dfc68a402511001becd734d9770594dd46e6d6
Link:
https://www.unpac.me/results/3b37eac1-ec60-4b8b-a09f-5671e4e02800/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5491a5396646/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5491a53966466e8178f248873652350a5c1c9128e64732f857f42277cbf5d825

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/462638/
  
URLhaus
https://urlhaus.abuse.ch/url/2725854/

Comments