24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 2e835c7496fb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e835c7496fb…. Malware family: Malware. Threat score 100/100. 20/25 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb"],"about":{"@type":"SoftwareApplication","name":"06206fe97fed0f338fd02cb39ed63174","applicationCategory":["pedll","executable"],"identifier":"2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":20,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T92c,"rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007752) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00008036) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006924) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007088) "WerFault.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007596) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004912) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001940) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001532) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006100) "WerFault.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007400) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00002604) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003816) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005960) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007852) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007692) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007240) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006620) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007152) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003616) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007960) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005836) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003896) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006084) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006272) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00008052)26:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e296777007144000000000038000000380000000000430028f51c001cf51c00000000003062dc000000000000000400d00740004000000000000a0011000000000040004c01010430d0000000f80000c7dd0100586e440060ae43000a000000000000002000000000004000d80140007c0c400000000000780c40000100000020f51c005916677738000000080000000100000000004300370666774000000000000000000000000800000002000000000043003800000008000000ffffffff44f51c00ee13677700000000ee13677708000000000000000000000000008972feffffff00714400000000000000000000000000ac09bb7260f51c00 (UID: 00000000-00007752) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008036) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e2967778070fd020000000038000000380000000000fc02a0f39c0094f39c00000000003062dc000000000000000400d007c0004000000000000a00260000000000c0004c0101044cb5000000f80000c7dd0100586efd0260aefc020800000000000000200000000000c000d801c0007c0cc00000000000780cc0000100000098f39c00591667773800000008000000010000000000fc023706667740000000000000000000000008000000020000000000fc023800000008000000ffffffffbcf39c00ee13677700000000ee13677708000000000000000000000000008972feffffff8070fd02000000000000000000000000ac09bb72d8f39c00 (UID: 00000000-00008036) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006924) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e2967778073a4000000000038000000380000000000a30030f0670024f06700000000003062dc000000000000000400d00776004000000000000a0024000000000076004c010104720a000000f80000c7dd0100586ea40060aea30014000000000000002000000000007600d80176007c0c760000000000780c76000100000028f06700591667773800000008000000010000000000a3003706667740000000000000000000000008000000020000000000a3003800000008000000ffffffff4cf06700ee13677700000000ee13677708000000000000000000000000008972feffffff8073a400000000000000000000000000ac09bb7268f06700 (UID: 00000000-00006924) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007088) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e2967774074b0000000000038000000380000000000af0068f08b005cf08b00000000003062dc000000000000000400d0079c004000000000000a000f00000000009c004c010104e466000000f80000c7dd0100586eb00060aeaf0017000000000000002000000000009c00d8019c007c0c9c0000000000780c9c000100000060f08b00591667773800000008000000010000000000af003706667740000000000000000000000008000000020000000000af003800000008000000ffffffff84f08b00ee13677700000000ee13677708000000000000000000000000008972feffffff4074b000000000000000000000000000ac09bb72a0f08b00 (UID: 00000000-00007088) "WerFault.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007596) "WerFault.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e29677700738b0000000000380000003800000000008a0080f3490074f34900000000003062dc000000000000000400d0075a004000000000000a002a00000000005a004c0101046b19000000f80000c7dd0100586e8b0060ae8a0012000000000000002000000000005a00d8015a007c0c5a0000000000780c5a000100000078f349005916677738000000080000000100000000008a0037066677400000000000000000000000080000000200000000008a003800000008000000ffffffff9cf34900ee13677700000000ee13677708000000000000000000000000008972feffffff00738b00000000000000000000000000ac09bb72b8f34900 (UID: 00000000-00007596) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004912) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e296777006f9d0000000000380000003800000000009c00e8f68900dcf68900000000003062dc000000000000000400d0078c004000000000000a001b00000000008c004c010104d27d000000f80000c7dd0100586e9d0060ae9c0002000000000000002000000000008c00d8018c007c0c8c0000000000780c8c0001000000e0f689005916677738000000080000000100000000009c0037066677400000000000000000000000080000000200000000009c003800000008000000ffffffff04f78900ee13677700000000ee13677708000000000000000000000000008972feffffff006f9d00000000000000000000000000ac09bb7220f78900 (UID: 00000000-00004912) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001940) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e2967774073730000000000380000003800000000007200d0f34300c4f34300000000003062dc000000000000000400d00752004000000000000a001f000000000052004c010104024d000000f80000c7dd0100586e730060ae720013000000000000002000000000005200d80152007c0c520000000000780c520001000000c8f343005916677738000000080000000100000000007200370666774000000000000000000000000800000002000000000072003800000008000000ffffffffecf34300ee13677700000000ee13677708000000000000000000000000008972feffffff40737300000000000000000000000000ac09bb7208f44300 (UID: 00000000-00001940) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001532) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e2967770072a8000000000038000000380000000000a700c8f46c00bcf46c00000000003062dc000000000000000400d0077d004000000000000a000400000000007d004c01010486d8000000f80000c7dd0100586ea80060aea7000e000000000000002000000000007d00d8017d007c0c7d0000000000780c7d0001000000c0f46c00591667773800000008000000010000000000a7003706667740000000000000000000000008000000020000000000a7003800000008000000ffffffffe4f46c00ee13677700000000ee13677708000000000000000000000000008972feffffff0072a800000000000000000000000000ac09bb7200f56c00 (UID: 00000000-00001532) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006100) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e296777807182000000000038000000380000000000810038f55b002cf55b00000000003062dc000000000000000400d0075f004000000000000a001900000000005f004c010104f300000000f80000c7dd0100586e820060ae81000c000000000000002000000000005f00d8015f007c0c5f0000000000780c5f000100000030f55b005916677738000000080000000100000000008100370666774000000000000000000000000800000002000000000081003800000008000000ffffffff54f55b00ee13677700000000ee13677708000000000000000000000000008972feffffff80718200000000000000000000000000ac09bb7270f55b00 (UID: 00000000-00006100) "WerFault.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007400) "WerFault.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e296777407033030000000038000000380000000000320300f62b01f4f52b01000000003062dc000000000000000400d00730034000000000000a001f000000000030034c01010412c6000000f80000c7dd0100586e330360ae320307000000000000002000000000003003d80130037c0c300300000000780c300301000000f8f52b015916677738000000080000000100000000003203370666774000000000000000000000000800000002000000000032033800000008000000ffffffff1cf62b01ee13677700000000ee13677708000000000000000000000000008972feffffff40703303000000000000000000000000ac09bb7238f62b01 (UID: 00000000-00007400) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002604) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e296777c06f190300000000380000003800000000001803f8efd100ecefd100000000003062dc000000000000000400d007d5004000000000000a000a0000000000d5004c010104da00000000f80000c7dd0100586e190360ae18030500000000000000200000000000d500d801d5007c0cd50000000000780cd50001000000f0efd1005916677738000000080000000100000000001803370666774000000000000000000000000800000002000000000018033800000008000000ffffffff14f0d100ee13677700000000ee13677708000000000000000000000000008972feffffffc06f1903000000000000000000000000ac09bb7230f0d100 (UID: 00000000-00002604) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003816) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000009e29677740744b0300000000380000003800000000004a0340f52b0134f52b01000000003062dc000000000000000400d00730034000000000000a0015000000000030034c0101040499000000f80000c7dd0100586e4b0360ae4a0317000000000000002000000000003003d80130037c0c300300000000780c30030100000038f52b015916677738000000080000000100000000004a0337066677400000000000000000000000080000000200000000004a033800000008000000ffffffff5cf52b01ee13677700000000ee13677708000000000000000000000000008972feffffff40744b03000000000000000000000000ac09bb7278f52b01 (UID: 00000000-00003816) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005960)27:T4142,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007752) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007752) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007752) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007752) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007752) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008036) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008036) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007088) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007088) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007088) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007088) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007088) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007596) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007596) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007596) "WerFault.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007596) "WerFault.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007596) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004912) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004912) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001940) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001532) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001532) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001532) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001532) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001532) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006100) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006100) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006100) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007400) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007400) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007400) "WerFault.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007400) "WerFault.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002604) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002604) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003816) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003816) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005960) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005960) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007852) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007852) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007852) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007852) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007852) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007692) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007692) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007240) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007240) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007240) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007240) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007240) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006620) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006620) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007152) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007152) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007152) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007152) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007152) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003616) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003616) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007960) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007960) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007960) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005836) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005836) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003896) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003896) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006084) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006084) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006084) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006084) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006084) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006272) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006272) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006272) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006272) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006272) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008052) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008052) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008052) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008052) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008052) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007972) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007972) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003608) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003608) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003608) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003608) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003608) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003420) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003420) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005872) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005872) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005872) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005872) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005872) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003864) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002824) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002824) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002824) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002824) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002824) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004076)28:T1082,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp")29:T9896,Found reference to API (Indicator: "InternetErrorDlg"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InternetCloseHandle"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InternetReadFile"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "HttpQueryInfoA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "HttpSendRequestA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "HttpOpenRequestA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InternetConnectA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InternetOpenA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetUserNameA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegCloseKey"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegQueryValueExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegOpenKeyExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "OpenProcessToken"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegEnumValueA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegEnumKeyExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegDeleteKeyA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegEnumKeyA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RegDeleteValueA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetMessageA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "PostThreadMessageA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "DestroyWindow"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SendMessageA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "IsWindow"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateWindowExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetDesktopWindow"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CloseClipboard"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "EmptyClipboard"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetClipboardData"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "OpenClipboard"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "wsprintfA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "DeleteObject"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "BitBlt"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SelectObject"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "DeleteDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateCompatibleDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetDeviceCaps"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateDCA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetAdaptersInfo"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "PathFileExistsA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetModuleBaseNameA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "EnumProcessModules"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "EnumProcesses"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "Sleep"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetTickCount"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetCurrentThread"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "DeleteFileA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetFileAttributesA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetLocalTime"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetProcessWorkingSetSize"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetComputerNameA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetLastError"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateMutexA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetModuleFileNameA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CloseHandle"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetCurrentProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetCurrentThreadId"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetVersion"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "WaitForSingleObject"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateProcessA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetVersionExA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "OpenProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "DeviceIoControl"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateFileA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FindClose"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FindNextFileA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FindFirstFileA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetTempPathA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "RemoveDirectoryA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetDriveTypeA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "ExitProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "lstrcatA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "TerminateProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "lstrlenA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "lstrcmpiA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "ReadFile"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "PeekNamedPipe"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetExitCodeProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetStartupInfoA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreatePipe"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetFilePointer"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "WideCharToMultiByte"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GlobalUnlock"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GlobalLock"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GlobalSize"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "VirtualQuery"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "VirtualProtect"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "ResumeThread"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FlushInstructionCache"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetThreadContext"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetThreadContext"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SuspendThread"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "VirtualAlloc"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "FreeLibrary"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetProcAddress"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "LoadLibraryA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetLastError"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetModuleHandleA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "ReleaseDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetDIBits"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "GetObjectA"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SetStretchBltMode"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "StretchBlt"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "SleepEx"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004076.00000000.79998.00710000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005836.00000000.74148.00DC1000.00000020.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006084.00000000.74206.030A0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00007692.00000000.71043.034B0000.00000004.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "EnumProcesses"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00008036.00000000.66452.02FC0000.00000004.mdmp")2a:T101b,Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003816.00000000.70301.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003864.00000000.78787.03080000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003896.00000000.74164.03070000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004076.00000000.79998.00710000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004912.00000000.67196.009C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005836.00000000.74148.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005872.00000000.78026.031F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005960.00000000.70307.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006000.00000000.78072.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006084.00000000.74206.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006100.00000000.68397.00810000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006272.00000000.74943.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006620.00000000.72229.00C70000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006924.00000000.66456.00A30000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007088.00000000.66460.00AF0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007152.00000000.72262.00610000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007240.00000000.72223.032F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007400.00000000.79950.03320000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007596.00000000.76096.008A0000.00000004.mdmp")2b:T409,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "?GetLastError@CxImage@@QAEPADXZ" (Indicator: "GetLastError"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "?GetLastError@CxImage@@QAEPADXZ" (Indicator: "GetLastError"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")2c:Ta7f,"06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxFile@@QAE@ABV0@@Z" at ordinal 1 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxFile@@QAE@XZ" at ordinal 2 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxIOFile@@QAE@ABV0@@Z" at ordinal 3 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxIOFile@@QAE@PAU_iobuf@@@Z" at ordinal 4 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxImage@@QAE@ABV0@_N11@Z" at ordinal 5 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxImage@@QAE@K@Z" at ordinal 6 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxImage@@QAE@KKKK@Z" at ordinal 7 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxImageJPG@@QAE@ABV0@@Z" at ordinal 8 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxImageJPG@@QAE@XZ" at ordinal 9 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxMemFile@@QAE@ABV0@@Z" at ordinal 10 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??0CxMemFile@@QAE@PAEK@Z" at ordinal 11 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??1CxFile@@UAE@XZ" at ordinal 12 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??1CxIOFile@@UAE@XZ" at ordinal 13 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??1CxImage@@UAE@XZ" at ordinal 14 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??1CxImageJPG@@UAE@XZ" at ordinal 15 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??1CxMemFile@@UAE@XZ" at ordinal 16 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4CxFile@@QAEAAV0@ABV0@@Z" at ordinal 17 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4CxIOFile@@QAEAAV0@ABV0@@Z" at ordinal 18 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4CxImage@@QAEAAV0@ABV0@@Z" at ordinal 19 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4CxImageJPG@@QAEAAV0@ABV0@@Z" at ordinal 20 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4CxMemFile@@QAEAAV0@ABV0@@Z" at ordinal 21 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??4tagCxTextInfo@@QAEAAU0@ABU0@@Z" at ordinal 22 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??_7CxFile@@6B@" at ordinal 23 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??_7CxIOFile@@6B@" at ordinal 24 "06206fe97fed0f338fd02cb39ed63174" contains export function called "??_7CxImage@@6B@" at ordinal 252d:T513,"SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion" in Source: 06206fe97fed0f338fd02cb39ed63174 "SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion" in Source: 06206fe97fed0f338fd02cb39ed63174 "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 06206fe97fed0f338fd02cb39ed63174 "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 06206fe97fed0f338fd02cb39ed63174 "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CLASSES_ROOT\exefile\shell\open\command;" in Source: 06206fe97fed0f338fd02cb39ed63174 "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" in Source: 06206fe97fed0f338fd02cb39ed63174 "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders" in Source: 28435-746-100068FA2e:Tb30,Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#1" (UID: 00000000-00007752) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#2" (UID: 00000000-00008036) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#3" (UID: 00000000-00006924) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#4" (UID: 00000000-00007088) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#5" (UID: 00000000-00004912) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#6" (UID: 00000000-00001940) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#7" (UID: 00000000-00001532) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#8" (UID: 00000000-00006100) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#9" (UID: 00000000-00002604) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#10" (UID: 00000000-00003816) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#11" (UID: 00000000-00005960) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#12" (UID: 00000000-00007852) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#13" (UID: 00000000-00007692) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#14" (UID: 00000000-00007240) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#15" (UID: 00000000-00006620) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#16" (UID: 00000000-00007152) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#17" (UID: 00000000-00003616) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#18" (UID: 00000000-00007960) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#19" (UID: 00000000-00005836) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#20" (UID: 00000000-00003896) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#21" (UID: 00000000-00006084) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#22" (UID: 00000000-00006272) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#23" (UID: 00000000-00008052) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#25" (UID: 00000000-00007972) Process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#26" (UID: 00000000-00003608)2f:T56e,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751f0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 751f0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 751f0000 "rundll32.exe" loaded module "KERNEL32" at base 74f30000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73990000 "rundll32.exe" loaded module "IMM32.DLL" at base 755d0000 "rundll32.exe" loaded module "C:\06206FE97FED0F338FD02CB39ED63174.DLL" at base 10000000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ad0000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74f30000 "WerFault.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751f0000 "WerFault.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 751f0000 "WerFault.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 751f0000 "WerFault.exe" loaded module "KERNEL32" at base 74f30000 "WerFault.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73990000 "WerFault.exe" loaded module "IMM32.DLL" at base 755d0000 "WerFault.exe" loaded module "C:\06206FE97FED0F338FD02CB39ED63174.DLL" at base 10000000 "WerFault.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ad0000 "WerFault.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74f3000030:Ta0b,Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#2" (UID: 00000000-00008036) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#3" (UID: 00000000-00006924) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#4" (UID: 00000000-00007088) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 7752 -ip 7752" (UID: 00000000-00008060) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 8036 -ip 8036" (UID: 00000000-00000416) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 6924 -ip 6924" (UID: 00000000-00007596) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007984) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00004708) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007628) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00005660) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7088 -ip 7088" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00006916) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007976) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00007760) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00000504) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00005716) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00005988) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00004672) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#5" (UID: 00000000-00004912) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4912 -ip 4912" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00006872) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001380) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001436) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#6" (UID: 00000000-00001940) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#7" (UID: 00000000-00001532)31:Ta0b,Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#2" (UID: 00000000-00008036) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#3" (UID: 00000000-00006924) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#4" (UID: 00000000-00007088) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 7752 -ip 7752" (UID: 00000000-00008060) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 8036 -ip 8036" (UID: 00000000-00000416) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 6924 -ip 6924" (UID: 00000000-00007596) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007984) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00004708) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007628) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00005660) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7088 -ip 7088" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00006916) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007976) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00007760) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00000504) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00005716) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00005988) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00004672) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#5" (UID: 00000000-00004912) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4912 -ip 4912" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00006872) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001380) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001436) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#6" (UID: 00000000-00001940) Spawned process "rundll32.exe" with commandline ""C:\\06206fe97fed0f338fd02cb39ed63174.dll",#7" (UID: 00000000-00001532)32:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")33:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")34:T5f2,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")35:T80c,Found reference to API "o@GetDIBits failed" (Indicator: "GetDIBits"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetDC" (Indicator: "GetDC"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetDIBits failed" (Indicator: "GetDIBits"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "o@GetDIBits failed" (Indicator: "GetDIBits"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")36:T646,Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")37:T5c0,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")38:T44e,Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "06206fe97fed0f338fd02cb39ed63174") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004912.00000000.67196.00DC9000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007752.00000000.66452.10036000.00000002.mdmp")39:Tef9,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001532.00000000.68381.00A70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001940.00000000.68377.00720000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002604.00000000.69121.03180000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002824.00000000.79915.031B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003420.00000000.77992.00820000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003608.00000000.76867.00B40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003816.00000000.70301.034A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003816.00000000.70301.034A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003864.00000000.78787.03080000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003864.00000000.78787.03080000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003896.00000000.74164.03070000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003896.00000000.74164.03070000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004076.00000000.79998.00710000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004076.00000000.79998.00710000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004076.00000000.79998.00710000.00000004.mdmp")3a:Td53,"Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00001532.00000000.68381.02F80000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00001532.00000000.68381.02F80000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002604.00000000.69121.03620000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00002604.00000000.69121.03620000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002824.00000000.79915.036B0000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00002824.00000000.79915.036B0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003420.00000000.77992.02F80000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00003420.00000000.77992.02F80000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003608.00000000.76867.031C0000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00003608.00000000.76867.031C0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003864.00000000.78787.03700000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00003864.00000000.78787.03700000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003896.00000000.74164.03650000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00003896.00000000.74164.03650000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004076.00000000.79998.02DF0000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00004076.00000000.79998.02DF0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004912.00000000.67196.03190000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00004912.00000000.67196.03190000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005836.00000000.74148.03190000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00005836.00000000.74148.03190000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005872.00000000.78026.036C0000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00005872.00000000.78026.036C0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005960.00000000.70307.035D0000.00000002.mdmp "!Progman" (Program manager) in Source: 00000000-00005960.00000000.70307.035D0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00006000.00000000.78072.02F80000.00000002.mdmp3b:Tc69,Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CLASSES_ROOT\exefile\shell\open\command;" (Indicator: "software\microsoft\windows\currentversion\run"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CLASSES_ROOT\exefile\shell\open\command;" (Indicator: "software\microsoft\windows\currentversion\runservices"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CLASSES_ROOT\exefile\shell\open\command;" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" (Indicator: "software\microsoft\active setup\installed components"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\run"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\runservices"; in File: "06206fe97fed0f338fd02cb39ed63174") Found string "reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\run;reglist \\HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\runservices;reglist \\HKEY_CURRENT_USER\SOFTWARE\microsoft\windows\currentversion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in File: "06206fe97fed0f338fd02cb39ed63174")3c:T1477,Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 7752 -ip 7752" (UID: 00000000-00008060) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 8036 -ip 8036" (UID: 00000000-00000416) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 6924 -ip 6924" (UID: 00000000-00007596) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007984) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00004708) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007628) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00005660) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7088 -ip 7088" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00006916) Spawned process "WerFault.exe" with commandline "-u -p 8036 -s 724" (UID: 00000000-00007976) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00007760) Spawned process "WerFault.exe" with commandline "-u -p 6924 -s 716" (UID: 00000000-00000504) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00005716) Spawned process "WerFault.exe" with commandline "-u -p 7752 -s 716" (UID: 00000000-00005988) Spawned process "WerFault.exe" with commandline "-u -p 7088 -s 716" (UID: 00000000-00004672) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4912 -ip 4912" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00006872) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001380) Spawned process "WerFault.exe" with commandline "-u -p 4912 -s 716" (UID: 00000000-00001436) Spawned process "WerFault.exe" with commandline "-pss -s 164 -p 1532 -ip 1532" (UID: 00000000-00002292) Spawned process "WerFault.exe" with commandline "-u -p 1532 -s 720" (UID: 00000000-00007468) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 1940 -ip 1940" (UID: 00000000-00005128) Spawned process "WerFault.exe" with commandline "-u -p 1532 -s 720" (UID: 00000000-00003804) Spawned process "WerFault.exe" with commandline "-u -p 1532 -s 720" (UID: 00000000-00002756) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 6100 -ip 6100" (UID: 00000000-00002672) Spawned process "WerFault.exe" with commandline "-u -p 6100 -s 716" (UID: 00000000-00002808) Spawned process "WerFault.exe" with commandline "-u -p 6100 -s 716" (UID: 00000000-00002852) Spawned process "WerFault.exe" with commandline "-u -p 6100 -s 716" (UID: 00000000-00002872) Spawned process "WerFault.exe" with commandline "-u -p 1940 -s 724" (UID: 00000000-00007400) Spawned process "WerFault.exe" with commandline "-u -p 1940 -s 724" (UID: 00000000-00002900) Spawned process "WerFault.exe" with commandline "-u -p 1940 -s 724" (UID: 00000000-00002888) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 2604 -ip 2604" (UID: 00000000-00002840) Spawned process "WerFault.exe" with commandline "-u -p 2604 -s 716" (UID: 00000000-00007028) Spawned process "WerFault.exe" with commandline "-u -p 2604 -s 716" (UID: 00000000-00003268) Spawned process "WerFault.exe" with commandline "-u -p 2604 -s 716" (UID: 00000000-00003520) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 5960 -ip 5960" (UID: 00000000-00002916) Spawned process "WerFault.exe" with commandline "-u -p 5960 -s 724" (UID: 00000000-00002588) Spawned process "WerFault.exe" with commandline "-u -p 5960 -s 724" (UID: 00000000-00007996) Spawned process "WerFault.exe" with commandline "-u -p 5960 -s 724" (UID: 00000000-00006804) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 3816 -ip 3816" (UID: 00000000-00006460) Spawned process "WerFault.exe" with commandline "-u -p 3816 -s 724" (UID: 00000000-00007428) Spawned process "WerFault.exe" with commandline "-u -p 3816 -s 724" (UID: 00000000-00007844) Spawned process "WerFault.exe" with commandline "-u -p 3816 -s 724" (UID: 00000000-00003356) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7852 -ip 7852" (UID: 00000000-00005380) Spawned process "WerFault.exe" with commandline "-u -p 7852 -s 716" (UID: 00000000-00006280) Spawned process "WerFault.exe" with commandline "-u -p 7852 -s 716" (UID: 00000000-00007124) Spawned process "WerFault.exe" with commandline "-u -p 7852 -s 716" (UID: 00000000-00007040) Spawned process "WerFault.exe" with commandline "-pss -s 524 -p 7692 -ip 7692" (UID: 00000000-00002152) Spawned process "WerFault.exe" with commandline "-u -p 7692 -s 716" (UID: 00000000-00008008) Spawned process "WerFault.exe" with commandline "-u -p 7692 -s 716" (UID: 00000000-00007932) Spawned process "WerFault.exe" with commandline "-u -p 7692 -s 716" (UID: 00000000-00005648) Spawned process "WerFault.exe" with commandline "-pss -s 428 -p 6620 -ip 6620" (UID: 00000000-00007072) Spawned process "WerFault.exe" with commandline "-pss -s 564 -p 7240 -ip 7240" (UID: 00000000-00007200) Spawned process "WerFault.exe" with commandline "-u -p 6620 -s 716" (UID: 00000000-00008160)3d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC3e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC3f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC40:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC41:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC42:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC43:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC44:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC45:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC46:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC47:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC48:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC49:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC50:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC51:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC52:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC53:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC54:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC55:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC56:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC57:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC58:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC59:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790786720018,"unified_at":"2026-09-30T16:45:20.018Z","metadata":{"hashes":{"sha256":"2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb","sha1":"24620848450863c080a386d1fee2524b84cd6b46","md5":"06206fe97fed0f338fd02cb39ed63174","sha512":"a6994f0a6768506156babe60ff7c0b7e1ea89b8b9e5d5bf0242106ef23b7d2dc88aa6795c3b0e585c1ada8aafd482c28ff24b5adc0fa93f258fb47f290afc291","ssdeep":"6144:7MiF7es10dzq+/VkBjUJhkl6FWBPQ0FwWVXRpdcJAP0tOQ+:7HF7T05HhJh+6uo0FDbmf+","ssdeep_chunks":["6144:7MiF7es","6144:MiF7es1","6144:iF7es10","6144:F7es10d","6144:7es10dz","6144:es10dzq","6144:s10dzq+","6144:10dzq+/","6144:0dzq+/V","6144:dzq+/Vk","6144:zq+/VkB","6144:q+/VkBj","6144:+/VkBjU","6144:/VkBjUJ","6144:VkBjUJh","6144:kBjUJhk","6144:BjUJhkl","6144:jUJhkl6","6144:UJhkl6F","6144:Jhkl6FW","6144:hkl6FWB","6144:kl6FWBP","6144:l6FWBPQ","6144:6FWBPQ0","6144:FWBPQ0F","6144:WBPQ0Fw","6144:BPQ0FwW","6144:PQ0FwWV","6144:Q0FwWVX","6144:0FwWVXR","6144:FwWVXRp","6144:wWVXRpd","6144:WVXRpdc","6144:VXRpdcJ","6144:XRpdcJA","6144:RpdcJAP","6144:pdcJAP0","6144:dcJAP0t","6144:cJAP0tO","6144:JAP0tOQ","6144:AP0tOQ+","12288:7MiF7es","12288:MiF7es1","12288:iF7es10","12288:F7es10d","12288:7es10dz","12288:es10dzq","12288:s10dzq+","12288:10dzq+/","12288:0dzq+/V","12288:dzq+/Vk","12288:zq+/VkB","12288:q+/VkBj","12288:+/VkBjU","12288:/VkBjUJ","12288:VkBjUJh","12288:kBjUJhk","12288:BjUJhkl","12288:jUJhkl6","12288:UJhkl6F","12288:Jhkl6FW","12288:hkl6FWB","12288:kl6FWBP","12288:l6FWBPQ","12288:6FWBPQ0","12288:FWBPQ0F","12288:WBPQ0Fw","12288:BPQ0FwW","12288:PQ0FwWV","12288:Q0FwWVX","12288:0FwWVXR","12288:FwWVXRp","12288:wWVXRpd","12288:WVXRpdc","12288:VXRpdcJ","12288:XRpdcJA","12288:RpdcJAP","12288:pdcJAP0","12288:dcJAP0t","12288:cJAP0tO","12288:JAP0tOQ","12288:AP0tOQ+","6144:7HF7T05","6144:HF7T05H","6144:F7T05Hh","6144:7T05HhJ","6144:T05HhJh","6144:05HhJh+","6144:5HhJh+6","6144:HhJh+6u","6144:hJh+6uo","6144:Jh+6uo0","6144:h+6uo0F","6144:+6uo0FD","6144:6uo0FDb","6144:uo0FDbm","6144:o0FDbmf","6144:0FDbmf+"],"imphash":"393ca4b24c450f0d771497a52bb9cd01"},"file_info":{"file_name":"06206fe97fed0f338fd02cb39ed63174","file_type":["pedll","executable"],"file_type_id":"dll","file_size":322440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1611403325000,"last_seen":1703151236000,"last_multi_scan":1703151236000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":51},"sandbox_signatures":{"informative_count":106,"suspicious_count":10,"malicious_count":5,"total":121},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Amber","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Genome","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Gericos.ser","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.DarkHotel.26","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1101756","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.DarkHotel.26 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.OKG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Garveep.e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0015e4f11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Agent.dkll","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BackDoor-FCJB!06206FE97FED","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.hwjxa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.FIO.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent3.ASRX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Genome.Win32.147549","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"Error SleepEx(): %d\" (Indicator: \"SleepEx\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SleepEx().\" (Indicator: \"SleepEx\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\C:; Source: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string - \\\\.\\PhysicalDrive; Source: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006084.00000000.74206.030A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WerFault.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Dim oWmiDim szGetObjectszGetObject = \"winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore\"Set oWmi = GetObject(szGetObject)oWmi.Enable(\"\")Set oWmi = Nothing\" (Indicator: \"\"set \"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"Dim oWmiDim szGetObjectszGetObject = \"winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore\"Set oWmi = GetObject(szGetObject)oWmi.Disable(\"\")Set oWmi = Nothing\" (Indicator: \"\"set \"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"Set the quality = %d\" (Indicator: \"set \"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"Set default device = %d\" (Indicator: \"set \"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"set size = %d KB\" (Indicator: \"set \"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"?GetVersion@CxImage@@QAEPBDXZ\" (Indicator: \"GetVersion\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"?GetVersion@CxImage@@QAEPBDXZ\" (Indicator: \"GetVersion\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 06206fe97fed0f338fd02cb39ed63174","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 06206fe97fed0f338fd02cb39ed63174)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c %s\" (Indicator: \"cmd.exe /c\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$2c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$2e","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 06206fe97fed0f338fd02cb39ed63174]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74CD0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EB0000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74CD0000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74B00000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74B00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"06206fe97fed0f338fd02cb39ed63174\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"06206fe97fed0f338fd02cb39ed63174\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"06206fe97fed0f338fd02cb39ed63174\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"06206fe97fed0f338fd02cb39ed63174\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"06206fe97fed0f338fd02cb39ed63174\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"06206fe97fed0f338fd02cb39ed63174\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\tebx,mov\tebx, dword ptr [ebp + 8],push\tesi,mov\tesi, dword ptr [ebp + 0xc],push\tedi,mov\tedi, dword ptr [ebp + 0x10],test\tesi, esi,jne\t0x10018ac7,cmp\tdword ptr [0x1004844c], 0,jmp\t0x10018aed,cmp\tesi, 1,je\t0x10018ad1,cmp\tesi, 2,jne\t0x10018af3,mov\teax, dword ptr [0x107b9694],test\teax, eax,je\t0x10018ae3,push\tedi,push\tesi,push\tebx,call\teax,test\teax, eax,je\t0x10018aef,push\tedi,push\tesi,push\tebx,call\t0x10018a00,test\teax, eax,jne\t0x10018af3,xor\teax, eax,jmp\t0x10018b41,push\tedi,push\tesi,push\tebx,call\t0x100010d9,cmp\tesi, 1,mov\tdword ptr [ebp + 0xc], eax,jne\t0x10018b0f,test\teax, eax,jne\t0x10018b3e,push\tedi,push\teax,push\tebx,call\t0x10018a00,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x77c698\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00007752) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00007752) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GTE CyberTrust Global Root, OU=\"GTE CyberTrust Solutions\n Inc.\", O=GTE Corporation, C=US\" (SHA1: 97:81:79:50:D8:1C:96:70:CC:34:D8:09:CF:79:44:31:36:7E:F4:74; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Cybertrust SureServer CA, O=GlobalSign Inc\" (SHA1: 09:6E:9B:47:56:94:74:64:DA:EA:5C:B5:E3:70:59:8D:CD:59:E8:24; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTE CyberTrust Global Root, OU=\"GTE CyberTrust Solutions\n Inc.\", O=GTE Corporation, C=US\" (SHA1: 91:F8:AA:B1:F7:C1:C5:66:61:1D:5D:6D:37:CA:E8:26:C3:A5:FD:48; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"06206fe97fed0f338fd02cb39ed63174\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7752)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 8036)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 6924)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7088)\n \"WerFault.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7596)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4912)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 1940)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"reglist \\\\HKEY_LOCAL_MACHINE\\SOFTWARE\\microsoft\\windows\\currentversion\\run;reglist \\\\HKEY_LOCAL_MACHINE\\SOFTWARE\\microsoft\\windows\\currentversion\\runservices;reglist \\\\HKEY_CURRENT_USER\\SOFTWARE\\microsoft\\windows\\currentversion\\Explorer\\User Shell Folders;reglist \\\\HKEY_CURRENT_USER\\SOFTWARE\\microsoft\\windows\\currentversion\\run;reglist \\\\HKEY_CURRENT_USER\\SOFTWARE\\microsoft\\windows\\currentversion\\runservices;reglist \\\\HKEY_CLASSES_ROOT\\exefile\\shell\\open\\command;\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"reglist \\\\HKEY_LOCAL_MACHINE\\SOFTWARE\\microsoft\\windows\\currentversion\\run;reglist \\\\HKEY_LOCAL_MACHINE\\SOFTWARE\\microsoft\\windows\\currentversion\\runservices;reglist \\\\HKEY_CURRENT_USER\\SOFTWARE\\microsoft\\windows\\currentversion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\WININET.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WININET.dll\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\AVICAP32.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\AVICAP32.dll\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\WINMM.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMM.dll\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\MSVFW32.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\MSVFW32.dll\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\WINMMBASE.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\06206FE97FED0F338FD02CB39ED63174.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\06206fe97fed0f338fd02cb39ed63174.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\06206FE97FED0F338FD02CB39ED63174.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\06206FE97FED0F338FD02CB39ED63174.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\06206FE97FED0F338FD02CB39ED63174.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\RUNDLL32.EXE.LOCAL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\rundll32.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://crl.globalsign.net/sureserver.crl0\"\n Pattern match: \"www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0\"\n Pattern match: \"http://www.public-trust.com/CPS/SureServer.html0\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Heuristic match: \"2.dll.mA\"\n Heuristic match: \"key.tR\"\n Heuristic match: \"2.dll.ma\"\n Heuristic match: \"dows.co\"\n Heuristic match: \"2.dll.mr\"\n Heuristic match: \"JS;.JSE;.WSF;.WS\"\n Heuristic match: \"2.dll.mn\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WerFault.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"Error GetSystemDirectory\" (Indicator: \"GetSystemDirectory\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir %s\" (Indicator: \"dir \"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Source: 06206fe97fed0f338fd02cb39ed63174]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"Sets information in a discretionary access control list (DACL)\" [Source: 06206fe97fed0f338fd02cb39ed63174]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004912.00000000.67196.00DC9000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007752.00000000.66452.10036000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"06206fe97fed0f338fd02cb39ed63174\" was detected as \"Microsoft visual C++ 6.0 DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"rundll32.exe queries ProcessDebugPort (UID: 7752), \"rundll32.exe queries ProcessDebugPort (UID: 8036)\n \"rundll32.exe queries ProcessDebugPort (UID: 6924), \"rundll32.exe queries ProcessDebugPort (UID: 7088)\n \"WerFault.exe queries ProcessDebugPort (UID: 7596), \"rundll32.exe queries ProcessDebugPort (UID: 4912)\n \"rundll32.exe queries ProcessDebugPort (UID: 1940), \"rundll32.exe queries ProcessDebugPort (UID: 1532)\n \"rundll32.exe queries ProcessDebugPort (UID: 6100), \"WerFault.exe queries ProcessDebugPort (UID: 7400)\n \"rundll32.exe queries ProcessDebugPort (UID: 2604), \"rundll32.exe queries ProcessDebugPort (UID: 3816)\n \"rundll32.exe queries ProcessDebugPort (UID: 5960)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"57/70 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"belinda.jablonski@syniverse.com1\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"Dim oWmiDim szGetObjectszGetObject = \"winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore\"Set oWmi = GetObject(szGetObject)oWmi.Enable(\"\")Set oWmi = Nothing\" (Indicator: \"winmgmts:\"; in File: \"06206fe97fed0f338fd02cb39ed63174\")\n Found string \"Dim oWmiDim szGetObjectszGetObject = \"winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore\"Set oWmi = GetObject(szGetObject)oWmi.Disable(\"\")Set oWmi = Nothing\" (Indicator: \"winmgmts:\"; in File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Sys@User : %s@%s (%s) C P U : %s System OS: %s (%s) Ping sec : %4dms %4dms %4dms -> average%4dms Net card : %s(%s)\" (Indicator: \"ping\"; File: \"06206fe97fed0f338fd02cb39ed63174\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n SetSecurityDescriptorDacl\n RegCloseKey\n OpenProcessToken\n GetUserNameA\n RegDeleteValueA\n RegOpenKeyExA\n RegEnumKeyA\n RegEnumKeyExA\n DeviceIoControl\n GetDriveTypeA\n VirtualProtect\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n OpenProcess\n DeleteFileA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n FindFirstFileA\n GetStartupInfoA\n GetComputerNameA\n FindNextFileA\n GetSystemDirectoryA\n CreateProcessA\n GetThreadContext\n Sleep\n TerminateProcess\n CreateFileA\n GetTickCount\n VirtualAlloc\n GetModuleFileNameExA\n EnumProcesses\n GetClipboardData\n HttpSendRequestA\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpQueryInfoA\n WSAStartup","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE files contains large number of export functions (more than 100)","description":"06206fe97fed0f338fd02cb39ed63174 contains more than 100 export function","origin":"Static Parser","relevance":5,"id":"static-98","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"57/70 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The signature of the certificate cannot be verified. (0x80096004)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}]}]},"activity":{"stats":{"process_count":155,"spawned_processes_count":155,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"65840684e24b6531e705363b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.DarkHotel","submit_name":"06206fe97fed0f338fd02cb39ed63174","analysis_start_time":"2023-12-21T09:33:56+00:00","indicators_count":{"informative":107,"suspicious":14,"malicious":5},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65840684e24b6531e705363b"}],"processes":[{"pid":7872,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00007872"},{"pid":7752,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007752"},{"pid":4708,"ppid":7752,"name":"WerFault.exe","command_line":"-u -p 7752 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007752","uid":"00000000-00004708"},{"pid":6916,"ppid":7752,"name":"WerFault.exe","command_line":"-u -p 7752 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007752","uid":"00000000-00006916"},{"pid":5988,"ppid":7752,"name":"WerFault.exe","command_line":"-u -p 7752 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007752","uid":"00000000-00005988"},{"pid":8036,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00008036"},{"pid":7984,"ppid":8036,"name":"WerFault.exe","command_line":"-u -p 8036 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008036","uid":"00000000-00007984"},{"pid":7628,"ppid":8036,"name":"WerFault.exe","command_line":"-u -p 8036 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008036","uid":"00000000-00007628"},{"pid":7976,"ppid":8036,"name":"WerFault.exe","command_line":"-u -p 8036 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008036","uid":"00000000-00007976"},{"pid":6924,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006924"},{"pid":5660,"ppid":6924,"name":"WerFault.exe","command_line":"-u -p 6924 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006924","uid":"00000000-00005660"},{"pid":504,"ppid":6924,"name":"WerFault.exe","command_line":"-u -p 6924 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006924","uid":"00000000-00000504"},{"pid":7088,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007088"},{"pid":7760,"ppid":7088,"name":"WerFault.exe","command_line":"-u -p 7088 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007088","uid":"00000000-00007760"},{"pid":5716,"ppid":7088,"name":"WerFault.exe","command_line":"-u -p 7088 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007088","uid":"00000000-00005716"},{"pid":4672,"ppid":7088,"name":"WerFault.exe","command_line":"-u -p 7088 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007088","uid":"00000000-00004672"},{"pid":4912,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00004912"},{"pid":6872,"ppid":4912,"name":"WerFault.exe","command_line":"-u -p 4912 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004912","uid":"00000000-00006872"},{"pid":1380,"ppid":4912,"name":"WerFault.exe","command_line":"-u -p 4912 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004912","uid":"00000000-00001380"},{"pid":1436,"ppid":4912,"name":"WerFault.exe","command_line":"-u -p 4912 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004912","uid":"00000000-00001436"},{"pid":1940,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00001940"},{"pid":7400,"ppid":1940,"name":"WerFault.exe","command_line":"-u -p 1940 -s 724","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001940","uid":"00000000-00007400"},{"pid":7700,"ppid":7400,"name":"WerFault.exe","command_line":"-u -p 7400 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007400","uid":"00000000-00007700"},{"pid":3056,"ppid":7400,"name":"WerFault.exe","command_line":"-u -p 7400 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007400","uid":"00000000-00003056"},{"pid":2508,"ppid":7400,"name":"WerFault.exe","command_line":"-u -p 7400 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007400","uid":"00000000-00002508"},{"pid":2900,"ppid":1940,"name":"WerFault.exe","command_line":"-u -p 1940 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001940","uid":"00000000-00002900"},{"pid":2888,"ppid":1940,"name":"WerFault.exe","command_line":"-u -p 1940 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001940","uid":"00000000-00002888"},{"pid":1532,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00001532"},{"pid":7468,"ppid":1532,"name":"WerFault.exe","command_line":"-u -p 1532 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001532","uid":"00000000-00007468"},{"pid":3804,"ppid":1532,"name":"WerFault.exe","command_line":"-u -p 1532 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001532","uid":"00000000-00003804"},{"pid":2756,"ppid":1532,"name":"WerFault.exe","command_line":"-u -p 1532 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001532","uid":"00000000-00002756"},{"pid":6100,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006100"},{"pid":2808,"ppid":6100,"name":"WerFault.exe","command_line":"-u -p 6100 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006100","uid":"00000000-00002808"},{"pid":2852,"ppid":6100,"name":"WerFault.exe","command_line":"-u -p 6100 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006100","uid":"00000000-00002852"},{"pid":2872,"ppid":6100,"name":"WerFault.exe","command_line":"-u -p 6100 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006100","uid":"00000000-00002872"},{"pid":2604,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#9","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00002604"},{"pid":7028,"ppid":2604,"name":"WerFault.exe","command_line":"-u -p 2604 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002604","uid":"00000000-00007028"},{"pid":3268,"ppid":2604,"name":"WerFault.exe","command_line":"-u -p 2604 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002604","uid":"00000000-00003268"},{"pid":3520,"ppid":2604,"name":"WerFault.exe","command_line":"-u -p 2604 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002604","uid":"00000000-00003520"},{"pid":3816,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#10","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003816"},{"pid":7428,"ppid":3816,"name":"WerFault.exe","command_line":"-u -p 3816 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003816","uid":"00000000-00007428"},{"pid":7844,"ppid":3816,"name":"WerFault.exe","command_line":"-u -p 3816 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003816","uid":"00000000-00007844"},{"pid":3356,"ppid":3816,"name":"WerFault.exe","command_line":"-u -p 3816 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003816","uid":"00000000-00003356"},{"pid":5960,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#11","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00005960"},{"pid":2588,"ppid":5960,"name":"WerFault.exe","command_line":"-u -p 5960 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005960","uid":"00000000-00002588"},{"pid":7996,"ppid":5960,"name":"WerFault.exe","command_line":"-u -p 5960 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005960","uid":"00000000-00007996"},{"pid":6804,"ppid":5960,"name":"WerFault.exe","command_line":"-u -p 5960 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005960","uid":"00000000-00006804"},{"pid":7852,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#12","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007852"},{"pid":6280,"ppid":7852,"name":"WerFault.exe","command_line":"-u -p 7852 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007852","uid":"00000000-00006280"},{"pid":7124,"ppid":7852,"name":"WerFault.exe","command_line":"-u -p 7852 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007852","uid":"00000000-00007124"},{"pid":7040,"ppid":7852,"name":"WerFault.exe","command_line":"-u -p 7852 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007852","uid":"00000000-00007040"},{"pid":7692,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#13","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007692"},{"pid":8008,"ppid":7692,"name":"WerFault.exe","command_line":"-u -p 7692 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007692","uid":"00000000-00008008"},{"pid":7932,"ppid":7692,"name":"WerFault.exe","command_line":"-u -p 7692 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007692","uid":"00000000-00007932"},{"pid":5648,"ppid":7692,"name":"WerFault.exe","command_line":"-u -p 7692 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007692","uid":"00000000-00005648"},{"pid":7240,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#14","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007240"},{"pid":7116,"ppid":7240,"name":"WerFault.exe","command_line":"-u -p 7240 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007240","uid":"00000000-00007116"},{"pid":4028,"ppid":7240,"name":"WerFault.exe","command_line":"-u -p 7240 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007240","uid":"00000000-00004028"},{"pid":4052,"ppid":7240,"name":"WerFault.exe","command_line":"-u -p 7240 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007240","uid":"00000000-00004052"},{"pid":6620,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#15","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006620"},{"pid":8160,"ppid":6620,"name":"WerFault.exe","command_line":"-u -p 6620 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006620","uid":"00000000-00008160"},{"pid":3932,"ppid":6620,"name":"WerFault.exe","command_line":"-u -p 6620 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006620","uid":"00000000-00003932"},{"pid":5088,"ppid":6620,"name":"WerFault.exe","command_line":"-u -p 6620 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006620","uid":"00000000-00005088"},{"pid":7152,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#16","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007152"},{"pid":5604,"ppid":7152,"name":"WerFault.exe","command_line":"-u -p 7152 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007152","uid":"00000000-00005604"},{"pid":5160,"ppid":7152,"name":"WerFault.exe","command_line":"-u -p 7152 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007152","uid":"00000000-00005160"},{"pid":7792,"ppid":7152,"name":"WerFault.exe","command_line":"-u -p 7152 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007152","uid":"00000000-00007792"},{"pid":3616,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#17","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003616"},{"pid":7960,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#18","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007960"},{"pid":6168,"ppid":7960,"name":"WerFault.exe","command_line":"-u -p 7960 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007960","uid":"00000000-00006168"},{"pid":7952,"ppid":7960,"name":"WerFault.exe","command_line":"-u -p 7960 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007960","uid":"00000000-00007952"},{"pid":5736,"ppid":7960,"name":"WerFault.exe","command_line":"-u -p 7960 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007960","uid":"00000000-00005736"},{"pid":5836,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#19","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00005836"},{"pid":3948,"ppid":5836,"name":"WerFault.exe","command_line":"-u -p 5836 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005836","uid":"00000000-00003948"},{"pid":3964,"ppid":5836,"name":"WerFault.exe","command_line":"-u -p 5836 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005836","uid":"00000000-00003964"},{"pid":3976,"ppid":5836,"name":"WerFault.exe","command_line":"-u -p 5836 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005836","uid":"00000000-00003976"},{"pid":3896,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#20","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003896"},{"pid":5812,"ppid":3896,"name":"WerFault.exe","command_line":"-u -p 3896 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003896","uid":"00000000-00005812"},{"pid":5796,"ppid":3896,"name":"WerFault.exe","command_line":"-u -p 3896 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003896","uid":"00000000-00005796"},{"pid":5596,"ppid":3896,"name":"WerFault.exe","command_line":"-u -p 3896 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003896","uid":"00000000-00005596"},{"pid":6084,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#21","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006084"},{"pid":4432,"ppid":6084,"name":"WerFault.exe","command_line":"-u -p 6084 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006084","uid":"00000000-00004432"},{"pid":6572,"ppid":6084,"name":"WerFault.exe","command_line":"-u -p 6084 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006084","uid":"00000000-00006572"},{"pid":4012,"ppid":6084,"name":"WerFault.exe","command_line":"-u -p 6084 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006084","uid":"00000000-00004012"},{"pid":6272,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#22","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006272"},{"pid":6728,"ppid":6272,"name":"WerFault.exe","command_line":"-u -p 6272 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006272","uid":"00000000-00006728"},{"pid":3876,"ppid":6272,"name":"WerFault.exe","command_line":"-u -p 6272 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006272","uid":"00000000-00003876"},{"pid":6196,"ppid":6272,"name":"WerFault.exe","command_line":"-u -p 6272 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006272","uid":"00000000-00006196"},{"pid":8052,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#23","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00008052"},{"pid":7908,"ppid":8052,"name":"WerFault.exe","command_line":"-u -p 8052 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008052","uid":"00000000-00007908"},{"pid":8000,"ppid":8052,"name":"WerFault.exe","command_line":"-u -p 8052 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008052","uid":"00000000-00008000"},{"pid":7972,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#25","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00007972"},{"pid":8108,"ppid":7972,"name":"WerFault.exe","command_line":"-u -p 7972 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007972","uid":"00000000-00008108"},{"pid":3512,"ppid":7972,"name":"WerFault.exe","command_line":"-u -p 7972 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007972","uid":"00000000-00003512"},{"pid":3800,"ppid":7972,"name":"WerFault.exe","command_line":"-u -p 7972 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007972","uid":"00000000-00003800"},{"pid":3608,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#26","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003608"},{"pid":6972,"ppid":3608,"name":"WerFault.exe","command_line":"-u -p 3608 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003608","uid":"00000000-00006972"},{"pid":7876,"ppid":3608,"name":"WerFault.exe","command_line":"-u -p 3608 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003608","uid":"00000000-00007876"},{"pid":948,"ppid":3608,"name":"WerFault.exe","command_line":"-u -p 3608 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003608","uid":"00000000-00000948"},{"pid":3420,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#27","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003420"},{"pid":1444,"ppid":3420,"name":"WerFault.exe","command_line":"-u -p 3420 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003420","uid":"00000000-00001444"},{"pid":7820,"ppid":3420,"name":"WerFault.exe","command_line":"-u -p 3420 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003420","uid":"00000000-00007820"},{"pid":5872,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#28","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00005872"},{"pid":7856,"ppid":5872,"name":"WerFault.exe","command_line":"-u -p 5872 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005872","uid":"00000000-00007856"},{"pid":3280,"ppid":5872,"name":"WerFault.exe","command_line":"-u -p 5872 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005872","uid":"00000000-00003280"},{"pid":4060,"ppid":5872,"name":"WerFault.exe","command_line":"-u -p 5872 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005872","uid":"00000000-00004060"},{"pid":6000,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#29","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00006000"},{"pid":1348,"ppid":6000,"name":"WerFault.exe","command_line":"-u -p 6000 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006000","uid":"00000000-00001348"},{"pid":1248,"ppid":6000,"name":"WerFault.exe","command_line":"-u -p 6000 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006000","uid":"00000000-00001248"},{"pid":1244,"ppid":6000,"name":"WerFault.exe","command_line":"-u -p 6000 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006000","uid":"00000000-00001244"},{"pid":3864,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#30","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00003864"},{"pid":6608,"ppid":3864,"name":"WerFault.exe","command_line":"-u -p 3864 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003864","uid":"00000000-00006608"},{"pid":5220,"ppid":3864,"name":"WerFault.exe","command_line":"-u -p 3864 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003864","uid":"00000000-00005220"},{"pid":5224,"ppid":3864,"name":"WerFault.exe","command_line":"-u -p 3864 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003864","uid":"00000000-00005224"},{"pid":2824,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#31","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00002824"},{"pid":7052,"ppid":2824,"name":"WerFault.exe","command_line":"-u -p 2824 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002824","uid":"00000000-00007052"},{"pid":508,"ppid":2824,"name":"WerFault.exe","command_line":"-u -p 2824 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002824","uid":"00000000-00000508"},{"pid":4076,"ppid":7872,"name":"rundll32.exe","command_line":"\"C:\\06206fe97fed0f338fd02cb39ed63174.dll\",#33","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00007872","uid":"00000000-00004076"},{"pid":7336,"ppid":4076,"name":"WerFault.exe","command_line":"-u -p 4076 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004076","uid":"00000000-00007336"},{"pid":3236,"ppid":4076,"name":"WerFault.exe","command_line":"-u -p 4076 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004076","uid":"00000000-00003236"},{"pid":3292,"ppid":4076,"name":"WerFault.exe","command_line":"-u -p 4076 -s 716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004076","uid":"00000000-00003292"},{"pid":8060,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 7752 -ip 7752","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008060","icon":"$3d"},{"pid":416,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 8036 -ip 8036","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000416","icon":"$3e"},{"pid":7596,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 6924 -ip 6924","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007596","icon":"$3f"},{"pid":7364,"ppid":7596,"name":"WerFault.exe","command_line":"-u -p 7596 -s 700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007596","uid":"00000000-00007364"},{"pid":7528,"ppid":7596,"name":"WerFault.exe","command_line":"-u -p 7596 -s 700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007596","uid":"00000000-00007528"},{"pid":7780,"ppid":7596,"name":"WerFault.exe","command_line":"-u -p 7596 -s 700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007596","uid":"00000000-00007780"},{"pid":7772,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7088 -ip 7088","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007772","icon":"$40"},{"pid":1288,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 4912 -ip 4912","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001288","icon":"$41"},{"pid":2292,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 164 -p 1532 -ip 1532","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002292","icon":"$42"},{"pid":5128,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 476 -p 1940 -ip 1940","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005128","icon":"$43"},{"pid":2672,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 6100 -ip 6100","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002672","icon":"$44"},{"pid":2840,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 2604 -ip 2604","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002840","icon":"$45"},{"pid":2916,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 476 -p 5960 -ip 5960","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002916","icon":"$46"},{"pid":6460,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 3816 -ip 3816","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006460","icon":"$47"},{"pid":5380,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7852 -ip 7852","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005380","icon":"$48"},{"pid":2152,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 7692 -ip 7692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002152","icon":"$49"},{"pid":7072,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 428 -p 6620 -ip 6620","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007072","icon":"$4a"},{"pid":7200,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 7240 -ip 7240","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007200","icon":"$4b"},{"pid":4668,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 428 -p 7152 -ip 7152","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004668","icon":"$4c"},{"pid":6952,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 176 -p 7960 -ip 7960","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006952","icon":"$4d"},{"pid":5692,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 5836 -ip 5836","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005692","icon":"$4e"},{"pid":5792,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 3896 -ip 3896","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005792","icon":"$4f"},{"pid":4288,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 6084 -ip 6084","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004288","icon":"$50"},{"pid":3824,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 6272 -ip 6272","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003824","icon":"$51"},{"pid":7140,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 8052 -ip 8052","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007140","icon":"$52"},{"pid":3024,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 176 -p 7596 -ip 7596","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003024","icon":"$53"},{"pid":4464,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 7972 -ip 7972","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004464","icon":"$54"},{"pid":644,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 3608 -ip 3608","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000644","icon":"$55"},{"pid":1440,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 3420 -ip 3420","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001440","icon":"$56"},{"pid":7180,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 5872 -ip 5872","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007180","icon":"$57"},{"pid":1344,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 6000 -ip 6000","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001344","icon":"$58"},{"pid":5816,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 3864 -ip 3864","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005816","icon":"$59"},{"pid":5560,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 7400 -ip 7400","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005560","icon":"$5a"},{"pid":1132,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 476 -p 4076 -ip 4076","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001132","icon":"$5b"}],"all_imported_dlls":["advapi32.dll","setupapi.dll","VxSSL32.dll","dwmapi.dll","iertutil.dll","apphelp.dll","sspicli.dll","sechost.dll","combase.dll","powrprof.dll","oleaut32.dll","IPHLPAPI.DLL","sfc.dll","KernelBase.dll","msvcrt.dll","cfgmgr32.dll","SHCore.dll","cryptbase.dll","mpr.dll","bcrypt.dll","fltLib.dll","kernel32.dll","AcLayers.dll","bcryptprimitives.dll","kernel.appcore.dll","imm32.dll","psapi.dll","uxtheme.dll","user32.dll","shell32.dll","rpcrt4.dll","windows.storage.dll","profapi.dll","06206fe97fed0f338fd02cb39ed63174.dll","wininet.dll","comctl32.dll","ntdll.dll","wow64cpu.dll","shlwapi.dll","imagehlp.dll","ws2_32.dll","msvfw32.dll","msctf.dll","wow64win.dll","gdi32.dll","msvcp_win.dll","wow64.dll","win32u.dll","ucrtbase.dll","sfc_os.dll","ole32.dll","avicap32.dll","winmm.dll","winmmbase.dll","gdi32full.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["65840684e24b6531e705363b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample 2e835c7496fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2e835c7496fb…. Malware family: Malware. Threat score 100/100. 20/25 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 2e835c7496fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2e835c7496fb…. Malware family: Malware. Threat score 100/100. 20/25 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2e835c7496fb4fc1c53665ef89fffdcbcc8dc49bea0baecc5b8496006ea601bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 2e835c7496fb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2e835c7496fb…. Malware family: Malware. Threat score 100/100. 20/25 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]