24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 8b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Infostealer/ACRStealer Sample 3442ef237e4b… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample 3442ef237e4b…. Malware family: Infostealer/ACRStealer. Threat score 82/100. 3/27 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead","keywords":["Malicious","Infostealer/ACRStealer","malware analysis","sandbox report","threat intelligence","3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead"],"about":{"@type":"SoftwareApplication","name":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","applicationCategory":["pedll","executable"],"identifier":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Infostealer/ACRStealer","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4a1,Found string "Bad compression level" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while finishing compression" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while finishing decompression" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "Can't allocate memory for compression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while creating compression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "Can't allocate memory for decompression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while creating decompression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while copying compression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "while copying decompression object" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")26:T11ea,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetTickCount64()" (Indicator: "GetTickCount64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTimeAsFileTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "kk:WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "Oi|k:WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceCounter()" (Indicator: "QueryPerformanceCounter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForSingleObject($module, handle, milliseconds, /)--Wait for a single object.Wait until the specified object is in the signaled state orthe time-out interval elapses. The timeout value is specifiedin milliseconds." (Indicator: "WaitForSingleObject"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WaitForMultipleObjects($module, handle_seq, wait_flag, milliseconds=_winapi.INFINITE, /)--" (Indicator: "WaitForMultipleObjects"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceCounter()" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "Oi|k:WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "kk:WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetTickCount64()" (Indicator: "GetTickCount64"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")27:T44f,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")28:T5be,Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "RegQueryReflectionKey" (Indicator: "RegQueryReflectionKey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "RegEnableReflectionKey" (Indicator: "RegEnableReflectionKey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "RegEnableReflectionKey" (Indicator: "RegEnableReflectionKey"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "RegQueryReflectionKey" (Indicator: "RegQueryReflectionKey"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")29:Ta1e,Found string "!"#$}%&'()*+},-./}}}}0123456}789:;<}}=>?}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin"), Found string "!"#$}%&'()*+} -./}}}}0123456}789:;<}}=>?}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin"), Found string "!"#$}%&'()*+},-./}}}}0123456}789:;<}}=>?}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found string "!"#$}%&'()*+} -./}}}}0123456}789:;<}}=>?}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")2a:T1183,Found reference to "CustomCryptoAlgorithmIsNotValidHashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "UnableToCreateHashAlgorithmFromAsymmetricCrypto" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "UnableToCreateKeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "UnableToCreateKeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "SHA384Type" (Indicator: "SHA384"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "SHA512Type" (Indicator: "SHA512"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "SHA512" (Indicator: "SHA512"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "TripleDES" (Indicator: "TripleDES"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "ECDsa" (Indicator: "ECDsa"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "AsnEncodedData" (Indicator: "AsnEncodedData"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "get_Oid" (Indicator: "Oid"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "s_serverAuthOid" (Indicator: "Oid"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "SubjectKeyIdentifierOid" (Indicator: "Oid"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "GetHashAlgorithmForSignature" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "IsSymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "GetSymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "IsAsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "GetAsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "NewSha1HashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "NewSha256HashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "get_HashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "NewHmacSha1KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "NewHmacSha1KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "get_CustomCryptoAlgorithmIsNotValidKeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to "get_CustomCryptoAlgorithmIsNotValidKeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")2b:T9ec,"rundll32.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-1851885288 [PID: 1548] "rundll32.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-1851939975 [PID: 1548] "rundll32.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-1852600839 [PID: 1548] "rundll32.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-1852608618 [PID: 1548] "rundll32.exe" queried SystemProcessInformation at 00000000-00002024-00000C15-1851993134 [PID: 2024] "rundll32.exe" queried SystemProcessInformation at 00000000-00002024-00000C15-1852001370 [PID: 2024] "rundll32.exe" queried SystemProcessInformation at 00000000-00002024-00000C15-1852539466 [PID: 2024] "rundll32.exe" queried SystemProcessInformation at 00000000-00002024-00000C15-1852558619 [PID: 2024] "rundll32.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-1851925106 [PID: 372] "rundll32.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-1851985892 [PID: 372] "rundll32.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-1852521227 [PID: 372] "rundll32.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-1852544249 [PID: 372] "rundll32.exe" queried SystemProcessInformation at 00000000-00000664-00000C15-1851857617 [PID: 664] "rundll32.exe" queried SystemProcessInformation at 00000000-00000664-00000C15-1851890186 [PID: 664] "rundll32.exe" queried SystemProcessInformation at 00000000-00000664-00000C15-1852259957 [PID: 664] "rundll32.exe" queried SystemProcessInformation at 00000000-00000664-00000C15-1852289846 [PID: 664] "rundll32.exe" queried SystemProcessInformation at 00000000-00001796-00000C15-1857632684 [PID: 1796] "rundll32.exe" queried SystemProcessInformation at 00000000-00001796-00000C15-1857642465 [PID: 1796] "rundll32.exe" queried SystemProcessInformation at 00000000-00001796-00000C15-1857841723 [PID: 1796] "rundll32.exe" queried SystemProcessInformation at 00000000-00001796-00000C15-1857850302 [PID: 1796] "WerFault.exe" queried SystemProcessInformation at 00000000-00008116-00000C15-2011938656 [PID: 8116] "WerFault.exe" queried SystemProcessInformation at 00000000-00008116-00000C15-2011947333 [PID: 8116] "WerFault.exe" queried SystemProcessInformation at 00000000-00008116-00000C15-2012123253 [PID: 8116] "WerFault.exe" queried SystemProcessInformation at 00000000-00008116-00000C15-2012131439 [PID: 8116] "rundll32.exe" queried SystemProcessInformation at 00000000-00002792-00000C15-1881721994 [PID: 2792]2c:T4c7,Process "WerFault.exe" [UID: 00000000-00006140] Process "WerFault.exe" [UID: 00000000-00007640] Process "WerFault.exe" [UID: 00000000-00001192] Process "WerFault.exe" [UID: 00000000-00001724] Process "WerFault.exe" [UID: 00000000-00007580] Process "WerFault.exe" [UID: 00000000-00006832] Process "WerFault.exe" [UID: 00000000-00003056] Process "WerFault.exe" [UID: 00000000-00006824] Process "WerFault.exe" [UID: 00000000-00005644] Process "WerFault.exe" [UID: 00000000-00007524] Process "WerFault.exe" [UID: 00000000-00004288] Process "WerFault.exe" [UID: 00000000-00005756] Process "WerFault.exe" [UID: 00000000-00008060] Process "WerFault.exe" [UID: 00000000-00006764] Process "WerFault.exe" [UID: 00000000-00004340] Process "WerFault.exe" [UID: 00000000-00004344] Process "WerFault.exe" [UID: 00000000-00005476] Process "WerFault.exe" [UID: 00000000-00008116] Process "WerFault.exe" [UID: 00000000-00003168] Process "WerFault.exe" [UID: 00000000-00003664] Process "WerFault.exe" [UID: 00000000-00007720] Process "WerFault.exe" [UID: 00000000-00007736] Process "WerFault.exe" [UID: 00000000-00007672] Process "WerFault.exe" [UID: 00000000-00006192] Process "WerFault.exe" [UID: 00000000-00004312]2d:T43e,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetTickCount64()" (Indicator: "GetTickCount"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "QueryPerformanceCounter()" (Indicator: "QueryPerformanceCounter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")2e:T3ff9,Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-1547-1E176F20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-1547-1E176F20 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-1634-1E16AAB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-1634-1E16AAB0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-2287-1E0C2FC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-2287-1E0C2FC0 Assembly shows XOR instruction xor edi eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD1Fh] eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD93h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 33D0EF59h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 856F58E6h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCF4h] AFBEC6BDh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax edx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CF7Eh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 6628EBF4h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 9F028A0Dh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi A4F475C2h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx dword ptr [1E31CE93h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi dword ptr [1E31CF00h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx ebp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx dword ptr [1E31CE21h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCADh] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx B21278C2h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi dword ptr [1E31CE7Eh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx A4EE95CAh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCD9h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDA9h] ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi BAF5BCFEh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 698DCC38h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx 165B4A7Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax 0A031201h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx dword ptr [1E31CF6Dh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CC81h] 6302DD9Bh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx CAC4DABFh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CE72h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CF85h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD98h] eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax dword ptr [1E31CF6Ch] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax FED753CFh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD93h] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi dword ptr [1E31CF8Bh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax C8CB4746h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 6439AE09h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi dword ptr [1E31CF28h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi C0B923DEh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax AF6E0F1Eh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDD4h] eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDD2h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 54C2C7ECh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx dword ptr [1E31CEBCh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx 8024ED98h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi C085A766h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDFFh] edx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi esp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD22h] ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDA2h] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx dword ptr [1E31CF45h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx E96FF1F7h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CF3Bh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 64EA5714h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx 8EDE39AAh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax BB2D099Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CF4Fh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCF7h] ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CF1Fh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CEFCh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CC94h] 1151FD01h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CC95h] CDF04FEAh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCBAh] eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CE0Ch] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax dword ptr [1E31CF8Ch] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax D851DB33h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 18980934h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax B6D88218h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 6498452Fh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx CB564286h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCCBh] edx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CF82h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCCCh] 939440B4h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax dword ptr [1E31CE54h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi 80E1C08Eh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx A640B1F6h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDB7h] ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx 467E5A74h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CC87h] CFE157A4h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 83CE4F74h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCAAh] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CC7Ch] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx B1D4E60Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDB2h] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx dword ptr [1E31CE2Bh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD09h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CF4Bh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CEE5h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx B5AAD08Bh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi ebp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CE9Bh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax DADC9A7Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax DE20276Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi F93E4E1Eh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax dword ptr [1E31CEF8h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDE1h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CCB6h] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx 6ECE535Ch in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx 1EFF6DE2h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi dword ptr [1E31CF5Eh] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx dword ptr [1E31CE4Ch] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD8Dh] ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx 96638089h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CE0Ah] 28BC07EBh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD43h] esi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 00002A00h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD62h] eax in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx dword ptr [1E31CE57h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi 0000256Ah in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ebx 697CA8F3h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CDC8h] edi in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax dword ptr [1E31CE5Ah] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx AEEFE1D4h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor esi ebp in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edi dword ptr [1E31CF02h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx 142996AAh in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor ecx edx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx dword ptr [1E31CF00h] in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD19h] ebx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor dword ptr [1E31CD90h] ecx in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor edx DCDDC460h in Stream UID: 10881-2379-1E05FE90 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-9847-1E168620 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-9847-1E168620 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-9850-1E1455A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-9850-1E1455A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-10179-1E11D3C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-10179-1E11D3C0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-10387-1E104400 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-10387-1E104400 Assembly shows XOR instruction xor eax edx in Stream UID: 10881-10716-1E0DE9F0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-10718-1E0DE2B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-10718-1E0DE2B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-10943-1E0BACA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-10943-1E0BACA0 Assembly shows XOR instruction xor byte ptr [edx+2Ah] dh in Stream UID: 10881-11107-1E0B3B20 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11108-1E0B3A00 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11108-1E0B3A00 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11125-1E0B3FF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11125-1E0B3FF0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11140-1E0B2D40 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11140-1E0B2D40 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11146-1E0B1BA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11146-1E0B1BA0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11343-1E09C8B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11343-1E09C8B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11344-1E09ADD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11344-1E09ADD0 Assembly shows XOR instruction xor ecx eax in Stream UID: 10881-11390-1E096790 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11611-1E089340 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11611-1E089340 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11615-1E0899E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11615-1E0899E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10881-11616-1E088CE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10881-11616-1E088CE0 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11650-1E086A90 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11650-1E086A90 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11654-1E086690 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11654-1E086690 Assembly shows XOR instruction xor eax esp in Stream UID: 10881-11655-1E086370 Assembly shows XOR instruction xor ecx esp in Stream UID: 10881-11655-1E0863702f:Tb32,Found string "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "MustSupportRefEncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "MustSupportRefEncryptedKeyName" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "EncryptedKeyHashValueType" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "EncryptedKeyTokenType" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "EncryptedKeyIdentifierClause" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "CreateTokenFromEncryptedKeyClause" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "get_EncryptedKeyContainsReferenceList" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "set_EncryptedKeyContainsReferenceList" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "_encryptedKeyContainsReferenceList" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "IsReaderAtEncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "GetEncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "encryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "EncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string ".w3.org/2001/04/xmlenc#EncryptedKey" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "ifierClause(EncryptedKey = {0}, Method '{1}')" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "p://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1" (Indicator: "encryptedkey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")30:T4c4,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – Cryptographic hashing algorithm31:T625d,Found XOR loop in file "sample.bin" at offset 573868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 573948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1760955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1959855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1972249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2082386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2140329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2226615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2265388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2272875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2360165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2983260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3354986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5101929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5102991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6563643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6609357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6620055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6625123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6643079; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6646251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6647337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6656831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6659713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6662539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6672595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6674695; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6675041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6679033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6683781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6684887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6689885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6690253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6693397; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6695735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6698255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6699127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6870829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6964778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6985668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6995361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7087753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7099110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7102478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 15422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 19504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 21554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 23598; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 27686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 29724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 36157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 36448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 36724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 36801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 164797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 164859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 171983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172398; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 221268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 279990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 407749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 536323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 575144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 575149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 645242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 645838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 832417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1046645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1087379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1087634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2072294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2258698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2272197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3277803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3382423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5119011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6594677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6599561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6628303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6632597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6647819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6649173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6658709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6667171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6670007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6720319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6720419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6720451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6751907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6815019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7038519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7070595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7120846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3027352; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 655843; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 684284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 684780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 891451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1119739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1437716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1560049; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1724282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1748455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1760822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1768019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1972048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1976464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2042083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2130897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2140196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2272742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2360032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3020516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3145363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3160187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3250995; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3903100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3905421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3934099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4130106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4485389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4485467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4766581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4774521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4774621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4777361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4777511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4793401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4793721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4795211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4806121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4807941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4827251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4827731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4833931; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4853111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4853141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4857336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4860951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5103422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5103440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5103458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5413990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6559502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6588460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6595312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6596512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6607144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6615276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6630646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6641532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6643040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6644160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6652528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6652720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6667952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6673260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6674676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6675028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6679668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6683752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6684780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6684872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6694344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6695696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6698232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6702692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6702812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6980222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7037280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7174568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7184232; code bytes = 803032:T6a8,Found system information discovery API: "ExpandEnvironmentStringsW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "GetSystemInfo" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "u:ExpandEnvironmentStrings" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "ExpandEnvironmentStrings" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "ExpandEnvironmentStrings($module, string, /)--Expand environment vars." in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found system information discovery API: "u:ExpandEnvironmentStrings" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStrings" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003968.00000001.186542.00A99000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003968.00000001.186542.00A99000.00000002.mdmp"33:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002024) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000372) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000664) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001796) "WerFault.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008116) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002792) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007888) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005676) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007104) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007440) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004088) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004980) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006360) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006120) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000680) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006108) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000780) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005912) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004964) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006816) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002620)34:T425,Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")35:T40d,Found string "set comprehension" (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Set field "elts" must be a list, not a %.200s" (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Set field "elts" changed size during iteration" (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Set changed size during iteration" (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "set changed size during iteration" (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Set state information for unpickling." (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Set and Fault or Close." (Indicator: "set "; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")36:T425,Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemTimeAsFileTime()" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")37:T52b,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "Py_GetVersion" (Indicator: "GetVersion"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetVersion($module, /)--Return the version number of the current operating system." (Indicator: "GetVersion"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "Py_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")38:T3136,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001548) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002024) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002024) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002024) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002024) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000664) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001796) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001796) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008116) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008116) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008116) "WerFault.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008116) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007888) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007888) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007888) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007888) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003968) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003968) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003968) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003968) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007104) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007104) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007440) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007440) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007440) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007440) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004088) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004088) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004088) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004088) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005996) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005996) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005996) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005996) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004980) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006360) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006120) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000680) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000680) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000680) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000680) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006108) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006108) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006108) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006108) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005384) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000780) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000780) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000780) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000780) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005912) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004964) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006816) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006816) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002620) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002620) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003136) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003136) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003136) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003136) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006284) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002300) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007416) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007416) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007416) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007416)39:T106f,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "ZZOOikOZO:CreateProcess" (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") file/memory contains long string with (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateProcessActionActivity" (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp")3a:T71c,Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "skkkkkk:CreateFile" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateFile($module, file_name, desired_access, share_mode, security_attributes, creation_disposition, flags_and_attributes, template_file, /)--" (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "skkkkkk:CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")3b:Tdd94,Found reference to API (Indicator: "RegConnectRegistryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegLoadKeyW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegDeleteValueW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegFlushKey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegEnumValueW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CryptGenRandom"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegDeleteKeyW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegSaveKeyW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetUserNameW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegCloseKey"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegEnumKeyExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegCreateKeyW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CryptAcquireContextA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetACP"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FindNextFileW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WriteFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateEventA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "TlsSetValue"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetSystemTimeAdjustment"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "MoveFileExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreatePipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CloseHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetTickCount"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RaiseException"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "OpenProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "VirtualFree"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetFilePointer"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FindClose"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ReadConsoleW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "TlsFree"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetEvent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileSize"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetVolumePathNameW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "LocalFree"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetVersionExA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "Sleep"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetHandleInformation"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetNumberOfConsoleInputEvents"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateProcessW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetHandleInformation"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "Process32First"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CancelIo"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "HeapFree"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetProcessTimes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateSemaphoreA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileType"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ReadFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "TlsGetValue"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateNamedPipeA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "TlsAlloc"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ExitProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateFileA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "HeapAlloc"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FlushViewOfFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "TerminateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetTickCount64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetVersion"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WaitNamedPipeA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "Process32Next"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FreeLibrary"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateFileW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ResetEvent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetFileTime"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FormatMessageW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetFileAttributesW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetErrorMode"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetStdHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "DeleteFileW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetProcAddress"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateHardLinkW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "PathCombineW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "VerQueryValueW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "getsockopt"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "WSAGetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CancelIoEx"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ShellExecuteW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateFile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CreateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetModuleFileName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "ExpandEnvironmentStrings"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "StrToInt64ExW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FreeSid"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "SetEntriesInAclW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "CommandLineToArgvW"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "DispatchMessage"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetMessage"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "GetLength"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001548.00000001.184604.00A91000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "PathCombineW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetVolumePathNameW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetNumberOfConsoleInputEvents"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "WaitNamedPipeA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAdjustment"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002300.00000000.194588.034E0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")3c:Tc09,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") file/memory contains long string with (Indicator: "ShellExecute"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001796.00000000.183414.032A0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002024.00000001.183088.00830000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002300.00000000.194588.034E0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002620.00000001.193060.031A0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002792.00000001.186535.00910000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003136.00000001.194265.03160000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003320.00000001.194262.006E0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003968.00000000.184937.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004088.00000000.186873.03500000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004964.00000000.191038.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004980.00000000.187273.02F00000.00000004.mdmp")3d:T46f,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetLastError($module, /)--" (Indicator: "GetLastError"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")3e:Td72,"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_Compile" at ordinal 1 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_CompileEx" at ordinal 2 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_CompileObject" at ordinal 3 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_FromNode" at ordinal 4 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_FromNodeObject" at ordinal 5 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAST_Validate" at ordinal 6 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArena_AddPyObject" at ordinal 7 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArena_Free" at ordinal 8 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArena_Malloc" at ordinal 9 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArena_New" at ordinal 10 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_Parse" at ordinal 11 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_ParseTuple" at ordinal 12 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 13 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_UnpackTuple" at ordinal 14 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_VaParse" at ordinal 15 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 16 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyArg_ValidateKeywordArguments" at ordinal 17 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAsyncGen_Fini" at ordinal 18 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAsyncGen_New" at ordinal 19 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyAsyncGen_Type" at ordinal 20 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyBaseObject_Type" at ordinal 21 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyBool_FromLong" at ordinal 22 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyBool_Type" at ordinal 23 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 24 "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" contains export function called "PyBuffer_FillInfo" at ordinal 253f:Teb4,Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#1" (UID: 00000000-00001548) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#2" (UID: 00000000-00002024) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#3" (UID: 00000000-00000372) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#4" (UID: 00000000-00000664) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#5" (UID: 00000000-00001796) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#6" (UID: 00000000-00002792) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#7" (UID: 00000000-00007888) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#8" (UID: 00000000-00003968) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#9" (UID: 00000000-00005676) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#10" (UID: 00000000-00007104) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#11" (UID: 00000000-00007440) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#12" (UID: 00000000-00004088) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#13" (UID: 00000000-00005996) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#14" (UID: 00000000-00004980) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#15" (UID: 00000000-00006360) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#16" (UID: 00000000-00006120) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#17" (UID: 00000000-00000680) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#18" (UID: 00000000-00006108) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#19" (UID: 00000000-00005384) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#20" (UID: 00000000-00000780) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#21" (UID: 00000000-00005912) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#22" (UID: 00000000-00004964) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#23" (UID: 00000000-00006816) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#24" (UID: 00000000-00002620) Process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll",#25" (UID: 00000000-00003320)40:T540,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74350000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74350000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74350000 "rundll32.exe" loaded module "KERNEL32" at base 740b0000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72770000 "rundll32.exe" loaded module "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL" at base 72070000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73430000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 740b0000 "WerFault.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74350000 "WerFault.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74350000 "WerFault.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74350000 "WerFault.exe" loaded module "KERNEL32" at base 740b0000 "WerFault.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72770000 "WerFault.exe" loaded module "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL" at base 72070000 "WerFault.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73430000 "WerFault.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 740b000041:Te27,Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002024), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000372) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000664), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00001796) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002792), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007888) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003968), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005676) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007104), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007440) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004088), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005996) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004980), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006360) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006120), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000680) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006108), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005384) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000780), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005912) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004964), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006816) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002620), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003320) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003136)42:Te27,Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002024), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000372) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000664), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00001796) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002792), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007888) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003968), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005676) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007104), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00007440) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004088), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005996) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004980), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006360) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006120), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000680) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006108), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005384) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00000780), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00005912) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00004964), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00006816) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00002620), Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003320) Spawned process "rundll32.exe" with commandline ""C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725c ..." (UID: 00000000-00003136)43:T57f,The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Time Stamping Root R46, O=Sectigo Limited, C=GB" (SHA1: C6:AE:54:E4:78:86:F1:7C:3D:55:12:48:8C:69:C3:4A:7A:F9:C2:DD; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: A2:54:82:1B:41:A5:9F:46:5F:FD:30:6C:BC:BD:33:77:81:B5:A5:AC; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Time Stamping CA R36, O=Sectigo Limited, C=GB" (SHA1: 38:C9:14:81:10:44:B4:DC:66:3E:93:D4:74:4B:81:41:86:A9:B5:B1; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 85:3D:63:2D:93:82:82:61:7C:D0:90:35:C4:91:DE:92:C1:42:DA:C7; see report for more information)44:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")45:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")46:T45e,"rundll32.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll.manifest" "rundll32.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.123.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.124.MANIFEST" "WerFault.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.MANIFEST" "WerFault.exe" trying to access non-existent file "C:\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll.manifest" "WerFault.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.123.MANIFEST" "WerFault.exe" trying to access non-existent file "C:\3442EF237E4BE9B964E7922253482CDBE557D9C8C44C519EA6FECF1725CDEEAD.BIN.DLL.124.MANIFEST"47:Te1e,Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "k|i:PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "Ok:CreatePipe" (Indicator: "CreatePipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "skkkkkkk:CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "k|i:ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreatePipe($module, pipe_attrs, size, /)--Create an anonymous pipe. pipe_attrs Ignored internally, can be None.Returns a 2-tuple of handles, to the read and write ends of the pipe." (Indicator: "CreatePipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateNamedPipe($module, name, open_mode, pipe_mode, max_instances, out_buffer_size, in_buffer_size, default_timeout, security_attributes, /)--" (Indicator: "CreateNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "PeekNamedPipe($module, handle, size=0, /)--" (Indicator: "PeekNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "ConnectNamedPipe($module, /, handle, overlapped=False)--" (Indicator: "ConnectNamedPipe"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "k|i:ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "skkkkkkk:CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "Ok:CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "k|i:PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp")48:T8f90,Pattern match: "a-aaaa.aaa/0123a4567a8aa9" Heuristic match: "lib\os.py" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://schemas.xmlsoap.org/2005/02/trust/tlsnego#tls_wrap" Pattern match: "http://schemas.xmlsoap.org/2005/02/trust/spnego#gss_wrap" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#hexbinary" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#x509subjectkeyidentifier" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#gss_kerberosv5_ap_req1510" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#kerberosv5apreqsha1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#encryptedkey" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv1.1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlid" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstrc/issuefinal" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rst/renew" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/renew" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/cancelfinal" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/renew" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/cancel" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/bearer" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/sct" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rst/sct" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/sct" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rst/sct/renew" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/sct/renew" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rst/sct/cancel" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/username" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/kerberos" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/rsa" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/tokentype" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/keytype" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/requirecryptographictoken" Pattern match: "http://schemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/isoptionaltokenproperty" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/anonymous" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/hash" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/rsa" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/sid" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/spn" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/system" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddress" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/homephone" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/webpage" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/right/identity" Pattern match: "http://schemas.microsoft.com/2006/08/servicemodel/dictionarytracerecord" Pattern match: "http://schemas.microsoft.com/2006/08/servicemodel/" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/completion" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/durable2pc" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/volatile2pc" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/commit" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/rollback" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/committed" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/aborted" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/prepare" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/prepared" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/readonly" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/replay" Pattern match: "http://docs.oasis-open.org/ws-tx/wsat/2006/06/fault" Pattern match: "http://docs.oasis-open.org/ws-tx/wscoor/2006/06" Pattern match: "http://docs.oasis-open.org/ws-tx/wscoor/2006/06/createcoordinationcontextresponse" Pattern match: "http://docs.oasis-open.org/ws-tx/wscoor/2006/06/register" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/closesequenceresponse" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/createsequence" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/sequenceacknowledgement" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/terminatesequence" Pattern match: "http://schemas.microsoft.com/2005/12/servicemodel/addressing/anonymous" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/ultimatereceiver" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/next" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://schemas.microsoft.com/ws/2005/05/envelope/none" Pattern match: "http://schemas.xmlsoap.org/soap/actor/next" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2005/08/addressing" Pattern match: "http://schemas.microsoft.com/ws/2006/05/rm" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/symmetrickey" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/nonce" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust/symmetrickey" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust/publickey" Pattern match: "http://schemas.microsoft.com/ws/2005/02/duplex" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/ackrequested" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/createsequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/createsequenceresponse" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/lastmessage" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/terminatesequence" Pattern match: "http://schemas.microsoft.com/ws/2006/02/tx/oletx" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/createcoordinationcontextresponse" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/register" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/registerresponse" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/completion" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/durable2pc" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/volatile2pc" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/commit" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/rollback" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/committed" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/aborted" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/prepare" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/prepared" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/readonly" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/replay" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/fault" Pattern match: "http://schemas.microsoft.com/2004/09/servicemodel/diagnostics" Pattern match: "http://schemas.microsoft.com/net/2006/05/peer" Pattern match: "http://schemas.microsoft.com/ws/2005/05/routing" Pattern match: "http://schemas.microsoft.com/ws/2005/05/addressing/none" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://tempuri.org/" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/securitybindingelement" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/issuerbinding" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/supportsecuritycontextcancellation" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/defaultmessagesecurityversion" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/transportscheme" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/targetaddress" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/listenuri" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/suppressauditfailure" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/isoutofbandtoken" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/supportingtokenattachmentmode" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/httpauthenticationscheme" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/privacynoticeuri" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/duplexclientlocaladdress" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/channelparameterscollection" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/spnego" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/anonymoussslnego" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/secureconversation" Pattern match: "http://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/dispatcher" Pattern match: "http://schemas.xmlsoap.org/ws/2004/09/policy" Pattern match: "http://www.w3.org/ns/ws-policy" Pattern match: "http://schemas.microsoft.com/2005/07/servicemodel" Pattern match: "http://www.w3.org/2005/08/addressing/soap/fault" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/viatoolong" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/contenttypeinvalid" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/connectiondispatchfailed" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/maxmessagesizeexceededfault" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/unsupportedversion" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/servertoobusy" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://tempuri.org/0" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#x509v3" Pattern match: "http://schemas.xmlsoap.org/ws/2005/07/securitypolicy" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#passwordtext" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#rsa-1_5" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#base64binary" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#text" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#gss_kerberosv5_ap_req" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#samlassertionid" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#thumbprintsha1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#encryptedkeysha1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv2.0" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2001/04/xmlenc#element" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc/sct" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/rstr/sct" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/rstr/sct/renew" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/rstr/sct/cancel" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust" Pattern match: "http://schemas.microsoft.com/net/2004/07/secext/tlsnego" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/rst/issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/ck/psha1" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/renew" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/spnego" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/issue" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/asymmetrickey" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/nonce" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/publickey" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512#binarysecret" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/renewfinal" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-trust/200512/rstr/cancel" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk" Pattern match: "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0" Pattern match: "http://www.docs.oasis-open.org/wss/2004/07/oasis-000000-wss-kerberos-token-profile-1.0" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#usernametoken" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprint" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uri" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/right" Pattern match: "http://schemas.microsoft.com/2004/10/e2etraceevent/tracerecord" Pattern match: "http://docs.oasis-open.org/ws-tx/wscoor/2006/06/registerresponse" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/ackrequested" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/closesequence" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/createsequenceresponse" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702" Pattern match: "http://schemas.microsoft.com/ws/2006/02/transactions" Pattern match: "http://www.w3.org/2005/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/none" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/rst/sct" Pattern match: "http://schemas.microsoft.com/ws/2006/05/security" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/rstr/issue" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/ck/psha1" Pattern match: "http://schemas.microsoft.com/2005/12/servicemodel/addressing/none" Pattern match: "http://schemas.microsoft.com/ws/2006/05/security/secureconversationfault" Pattern match: "http://schemas.microsoft.com/ws/2005/07/securitypolicy" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/mutualsslnego" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/securitycontexttoken" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/tokens/sspicredential" Pattern match: "http://www.w3.org/2003/05/soap-encoding" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/contenttypetoolong" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/endpointnotfound" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/endpointunavailable" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/serviceactivationfailed" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/unsupportedmode" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/faults/upgradeinvalid" Pattern match: "http://schemas.microsoft.com/ws/2006/05/framing/policy" Pattern match: "http://schemas.microsoft.com/ws/06/2004/policy/http" Pattern match: "http://schemas.xmlsoap.org/soap/http" Pattern match: "http://schemas.microsoft.com/soap/peer" Pattern match: "http://schemas.microsoft.com/soap/websocket" Pattern match: "http://schemas.microsoft.com/2011/02/websockets/onbinarymessage" Pattern match: "http://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/transactions" Pattern match: "http://schemas.microsoft.com/ws/2005/02/mex/bindings" Pattern match: "http://schemas.xmlsoap.org/ws/2004/09/transfer/get" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" Pattern match: "http://python.org/dev/peps/pep-0263/" Heuristic match: "%u%c__init__.py" Heuristic match: "%u.py" Heuristic match: "z9return none as built-in modules do not have code objects.nr" Heuristic match: "z8return none as built-in modules do not have source code.nr" Heuristic match: "z4return false as built-in modules are never packages.fr" Heuristic match: "z*use default semantics for module creation.nr" Heuristic match: "z6return none as frozen modules do not have source code.nr" Heuristic match: "z2resolve a relative module name to an absolute one.ru" Heuristic match: "parser.st" Heuristic match: "b\os.py" Pattern match: "myimport.zip/mydirectory" Heuristic match: "/__init__.py" Pattern match: "soap.org/ws/2005/02/sc/dk/p_sha1" Pattern match: "w.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "asis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" Pattern match: "docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#base64binary" Pattern match: "docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#text" Pattern match: "n.org/wss/oasis-wss-kerberos-token-profile-1.1#gss_kerberosv5_ap_req" Pattern match: "open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Pattern match: "docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#thumbprintsha1" Pattern match: "ocs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv2.0" Pattern match: "ocs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" Pattern match: "schemas.xmlsoap.org/ws/2005/02/sc/dk" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/rst/sct" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/rst/sct/renew" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/rst/sct/cancel" Pattern match: "mas.xmlsoap.org/ws/2005/02/trust#binarysecret" Pattern match: "mas.microsoft.com/net/2004/07/secext/ws-spnego" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/rst/issue" Pattern match: "chemas.xmlsoap.org/ws/2005/02/trust/issue" Pattern match: "xmlsoap.org/ws/2005/02/trust/ck/psha1" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/publickey" Pattern match: "mas.xmlsoap.org/ws/2005/02/trust/spnego" Pattern match: "docs.oasis-open.org/ws-sx/ws-trust/200512/rst/issue" Pattern match: "docs.oasis-open.org/ws-sx/ws-trust/200512/issue" Pattern match: "is-open.org/ws-sx/ws-trust/200512/symmetrickey" Pattern match: "ocs.oasis-open.org/ws-sx/ws-trust/200512/ck/psha1" Pattern match: "cs.oasis-open.org/ws-sx/ws-trust/200512" Pattern match: "is-open.org/ws-sx/ws-trust/200512/rstr/renew" Pattern match: "en.org/ws-sx/ws-trust/200512/rst/cancel" Pattern match: "n.org/ws-sx/ws-trust/200512/rstr/cancelfinal" Pattern match: "s.oasis-open.org/ws-sx/ws-trust/200512/cancel" Pattern match: "n.org/ws-sx/ws-secureconversation/200512/sct" Pattern match: "oasis-open.org/ws-sx/ws-trust/200512/rstr/sct" Pattern match: "open.org/ws-sx/ws-trust/200512/rstr/sct/renew" Pattern match: "open.org/ws-sx/ws-trust/200512/rstr/sct/cancel" Pattern match: "w3.org/2001/04/xmlenc#encryptedkey" Pattern match: "mas.microsoft.com/ws/2006/05/identitymodel/tokens/username" Pattern match: "rosoft.com/ws/2006/05/identitymodel/tokens/kerberos" Pattern match: "s.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/tokentype" Pattern match: "as.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/keytype" Pattern match: "as.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/requirecryptographictoken" Pattern match: "hemas.microsoft.com/ws/2006/05/identitymodel/securitytokenrequirement/isoptionaltokenproperty" Pattern match: "schemas.xmlsoap.org/ws/2005/05/identity/claims/anonymous" Pattern match: "schemas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "mlsoap.org/ws/2005/05/identity/claims/hash" Pattern match: "mlsoap.org/ws/2005/05/identity/claims/rsa" Pattern match: "mlsoap.org/ws/2005/05/identity/claims/spn" Pattern match: "oap.org/ws/2005/05/identity/claims/thumbprint" Pattern match: "as.xmlsoap.org/ws/2005/05/identity/claims/uri" Pattern match: "soap.org/ws/2005/05/identity/claims/surname" Pattern match: "tempuri.org/{0}/{1" Pattern match: "http://www.w3.org/2004/06/xmlmime" Pattern match: "ocs.oasis-open.org/ws-tx/wsat/2006/06" Pattern match: "pen.org/ws-tx/wsat/2006/06/durable2pc" Pattern match: "en.org/ws-tx/wsat/2006/06/commit" Pattern match: "en.org/ws-tx/wsat/2006/06/prepare" Pattern match: "n.org/ws-tx/wsat/2006/06/readonly" Pattern match: "pen.org/ws-tx/wsat/2006/06/fault" Pattern match: "oasis-open.org/ws-tx/wscoor/2006/06" Pattern match: "asis-open.org/ws-tx/wscoor/2006/06/registerresponse" Pattern match: "ocs.oasis-open.org/ws-rx/wsrm/200702/ackrequested" Pattern match: "docs.oasis-open.org/ws-rx/wsrm/200702/closesequenceresponse" Pattern match: "docs.oasis-open.org/ws-rx/wsrm/200702/createsequenceresponse" Pattern match: "asis-open.org/ws-rx/wsrm/200702" Pattern match: "is-open.org/ws-rx/wsrm/200702/sequenceacknowledgement" Pattern match: "http://docs.oasis-open.org/ws-rx/wsrm/200702/terminatesequenceresponse" Pattern match: "chemas.microsoft.com/2005/12/servicemodel/addressing/anonymous" Pattern match: "chemas.xmlsoap.org/ws/2002/12/policy" Pattern match: "xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "xmlsoap.org/soap/envelope/" Pattern match: "hemas.microsoft.com/net/2006/05/peer/hopcount" Pattern match: "s.microsoft.com/ws/2006/02/transactions" Pattern match: "schemas.xmlsoap.org/ws/2006/02/addressingidentity" Pattern match: "w3.org/2005/08/addressing/fault" Pattern match: "w.w3.org/2005/08/addressing/reply" Pattern match: "xmlsoap.org/ws/2004/08/addressing/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/sc" Pattern match: "as.xmlsoap.org/ws/2004/04/security/sc/sct" Pattern match: "oap.org/ws/2004/04/security/trust/rstr/sct" Pattern match: "schemas.xmlsoap.org/ws/2004/04/security/trust/rst/issue" Pattern match: "schemas.xmlsoap.org/ws/2004/04/security/trust/issue" Pattern match: "schemas.xmlsoap.org/ws/2004/04/security/trust/symmetrickey" Pattern match: "schemas.xmlsoap.org/ws/2005/02/rm/createsequence" Pattern match: "schemas.xmlsoap.org/ws/2005/02/rm/createsequenceresponse" Pattern match: "as.xmlsoap.org/ws/2005/02/rm/lastmessage" Pattern match: "schemas.xmlsoap.org/ws/2005/02/rm/terminatesequence" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wscoor" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wscoor/createcoordinationcontext" Pattern match: "emas.xmlsoap.org/ws/2004/10/wscoor/register" Pattern match: "soap.org/ws/2004/10/wscoor/fault" Pattern match: "chemas.xmlsoap.org/ws/2004/10/wsat" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wsat/commit" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wsat/committed" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wsat/prepare" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wsat/readonly" Pattern match: "schemas.xmlsoap.org/ws/2004/10/wsat/fault" Pattern match: "soft.com/net/2006/05/peer" Pattern match: "3.org/2001/xmlschema" Pattern match: "emas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/securityalgorithmsuite" Pattern match: "emas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/issueraddress" Pattern match: "emas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/secureconversationsecuritybindingelement" Pattern match: "mas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/issuerbindingcontext" Pattern match: "chemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/via" Pattern match: "rosoft.com/ws/2006/05/servicemodel/securitytokenrequirement/messageauthenticationauditlevel" Pattern match: "http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/messagedirection" Pattern match: "chemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/issuedsecuritytokenparameters" Pattern match: "osoft.com/ws/2006/05/servicemodel/tokens/mutualsslnego" Pattern match: "ft.com/ws/2006/05/servicemodel/tokens/securitycontexttoken" Pattern match: "soft.com/ws/2006/05/servicemodel/tokens/sspicredential" Pattern match: "chemas.microsoft.com/2003/10/serialization/" Pattern match: "http://schemas.microsoft.com/2003/10/serialization/arrays" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Pattern match: "as.xmlsoap.org/ws/2004/09/policy" Pattern match: "s.microsoft.com/ws/2006/05/framing/faults/viatoolong" Pattern match: "osoft.com/ws/2006/05/framing/faults/contenttypeinvalid" Pattern match: "osoft.com/ws/2006/05/framing/faults/maxmessagesizeexceededfault" Pattern match: "mas.microsoft.com/soap/websocket" Pattern match: "ww.w3.org/2000/xmlns/" Pattern match: "cs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#usernametoken" Pattern match: "mlsoap.org/ws/2005/07/securitypolicy" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" Pattern match: "3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "mlsoap.org/2005/02/trust/tlsnego#tls_wrap" Pattern match: "cs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#base64binary" Pattern match: "pen.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Pattern match: "docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#encryptedkeysha1" Pattern match: "docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv2.0" Pattern match: "cs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" Pattern match: "chemas.xmlsoap.org/ws/2005/02/sc/dk" Pattern match: "hemas.xmlsoap.org/ws/2005/02/trust/rst/sct" Pattern match: "emas.xmlsoap.org/ws/2005/02/trust/rst/sct/renew" Pattern match: "mas.xmlsoap.org/ws/2005/02/trust/rst/sct/cancel" Pattern match: "lsoap.org/ws/2005/02/trust#binarysecret" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/issue" Pattern match: "mas.xmlsoap.org/ws/2005/02/trust/ck/psha1" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/renew" Pattern match: "as.xmlsoap.org/ws/2005/02/trust/spnego" Pattern match: "ocs.oasis-open.org/ws-sx/ws-trust/200512/issue" Pattern match: "s-open.org/ws-sx/ws-trust/200512/symmetrickey" Pattern match: "cs.oasis-open.org/ws-sx/ws-trust/200512/ck/psha1" Pattern match: "s.oasis-open.org/ws-sx/ws-trust/200512" Pattern match: "n.org/ws-sx/ws-trust/200512/rst/cancel" Pattern match: "docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#str-transform" Pattern match: "ocs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0" Pattern match: "asis-open.org/wss/oasis-wss-saml-token-profile-1.0" Pattern match: "docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1" Pattern match: "soft.com/ws/2006/05/identitymodel/securitytokenrequirement" Pattern match: "emas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "ap.org/ws/2005/05/identity/claims/hash" Pattern match: "ap.org/ws/2005/05/identity/claims/rsa" Pattern match: "oap.org/ws/2005/05/identity/claims/denyonlysid" Pattern match: "mas.xmlsoap.org/ws/2005/05/identity/claims/system" Pattern match: "mlsoap.org/ws/2005/05/identity/claims/upn" Pattern match: "xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname" Pattern match: "schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" Pattern match: "emas.xmlsoap.org/ws/2005/05/identity/claims/locality" Pattern match: "lsoap.org/ws/2005/05/identity/claims/postalcode" Pattern match: "xmlsoap.org/ws/2005/05/identity/claims/homephone" Pattern match: "xmlsoap.org/ws/2005/05/identity/claims/mobilephone" Pattern match: "mlsoap.org/ws/2005/05/identity/claims/gender" Pattern match: "cs.oasis-open.org/ws-tx/wscoor/2006/06" Pattern match: "cs.oasis-open.org/ws-tx/wscoor/2006/06/registerresponse" Pattern match: "docs.oasis-open.org/ws-rx/wsrm/200702/ackrequested" Pattern match: "s-open.org/ws-rx/wsrm/200702/sequenceacknowledgement" Pattern match: "http://dummy" Pattern match: "chemas.xmlsoap.org/microsoft/windowscommunicationfoundation/2005/08/faults/" Pattern match: "icrosoft.com/ws/2006/02/transactions" Pattern match: "schemas.xmlsoap.org/ws/2004/08/addressing" Pattern match: "soap.org/ws/2004/08/addressing/fault" Pattern match: "schemas.xmlsoap.org/ws/2004/04/sc" Pattern match: "xmlsoap.org/ws/2004/04/security/sc/sct" Pattern match: "schemas.xmlsoap.org/ws/2005/02/trust/tlsnego" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/issue" Pattern match: "schemas.xmlsoap.org/ws/2004/04/trust/symmetrickey" Pattern match: "xmlsoap.org/ws/2005/02/rm/lastmessage" Pattern match: "hemas.xmlsoap.org/ws/2005/02/rm/terminatesequence" Pattern match: "hemas.xmlsoap.org/ws/2004/10/wscoor" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/createcoordinationcontext" Pattern match: "hemas.xmlsoap.org/ws/2004/10/wscoor/register" Pattern match: "lsoap.org/ws/2004/10/wscoor/fault" Pattern match: "hemas.xmlsoap.org/ws/2004/10/wsat" Pattern match: "chemas.xmlsoap.org/ws/2004/10/wsat/committed" Pattern match: "t.com/ws/2005/05/envelope/none" Pattern match: "w3.org/2001/xmlschema" Pattern match: "schemas.xmlsoap.org/soap/envelope/" Pattern match: "s.microsoft.com/2005/12/servicemodel/addressing/anonymous" Pattern match: "hemas.microsoft.com/servicemodel/2004/05/addressing" Pattern match: "ws-i.org/profiles/basic-security/core/1.0" Pattern match: "t.com/ws/2006/05/servicemodel/securitytokenrequirement/securityalgorithmsuite" Pattern match: "t.com/ws/2006/05/servicemodel/securitytokenrequirement/issueraddress" Pattern match: "t.com/ws/2006/05/servicemodel/securitytokenrequirement/secureconversationsecuritybindingelement" Pattern match: "crosoft.com/ws/2006/05/servicemodel/securitytokenrequirement/messagesecurityversion" Pattern match: "osoft.com/ws/2006/05/servicemodel/securitytokenrequirement/isinitiator" Pattern match: "oft.com/ws/2006/05/servicemodel/securitytokenrequirement/via" Pattern match: "icrosoft.com/ws/2006/05/servicemodel/securitytokenrequirement/prefersslcertificateauthenticator" Pattern match: "as.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/messagedirection" Pattern match: "soft.com/ws/2006/05/servicemodel/securitytokenrequirement/issuedsecuritytokenparameters" Pattern match: "mas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/endpointfiltertable" Pattern match: "osoft.com/ws/2006/05/servicemodel/securitytokenrequirement/extendedprotectionpolicy" Pattern match: "t.com/ws/2006/05/servicemodel/tokens/spnego" Pattern match: "soap.org/soap/encoding/" Pattern match: "icrosoft.com/2011/02/session/onopen" Pattern match: "chemas.microsoft.com/2005/07/servicemodel" Pattern match: "soft.com/ws/2006/05/framing/faults/" Pattern match: "oft.com/ws/2006/05/framing/faults/viatoolong" Pattern match: "http://schemas.microsoft.com/net/2006/06/duplex" Pattern match: "t.com/ws/2006/05/framing/policy" Pattern match: "oap.org/soap/http" Pattern match: "crosoft.com/soap/named-pipe" Pattern match: "hemas.xmlsoap.org/ws/2004/09/mex" Pattern match: "http://schemas.xmlsoap.org/ws/2004/09/transfer" Pattern match: "schemas.xmlsoap.org/ws/2004/09/transfer/getresponse" Pattern match: "w.w3.org/2006/05/addressing/wsdl" Pattern match: "schemas.xmlsoap.org/ws/2004/08/addressing/policy" Pattern match: "https://github.com/dotnet/wcf" Heuristic match: "example.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "ead.bin.dll.2.co" Heuristic match: "u0g'up.lu" Heuristic match: "c%.hm" Pattern match: "aea6a2a.afa/aoa" Heuristic match: "z5true if filenames must be checked case-insensitively.fr" Heuristic match: "z1test whether the path is the specified mode type.fi" Heuristic match: "z'return none as there is no source code.nr" Heuristic match: "z?return none as an extension module cannot create a code object.nr" Heuristic match: "z5return none as extension modules have no source code.nr" Heuristic match: "z.search sys.path_hooks for a finder for 'path'.nz" Heuristic match: "z?find the loader or namespace_path for this module/package name.nr" Heuristic match: "should only be called with the import lock taken.nc"49:Tfa4,Found string "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/Kerberos" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "CreateSecurityTokenAuthenticator : SecurityTokenTypes.Kerberos" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.docs.oasis-open.org/wss/2004/07/oasis-000000-wss-kerberos-token-profile-1.0" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosToken" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WssGssKerberosV5ApReqToken11" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosTokenType1510" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosTokenTypeGSS" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosTokenProfileNamespace" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WssGssKerberosV5ApReqToken11Name" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosTokenName" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "get_ProvidedNetworkCredentialsForKerberosHasInvalidUserName" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosHashValueType" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosRequestorSecurityToken" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosSecurityTokenProvider" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "KerberosSecurityTokenProviderWrapper" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "get_Kerberos" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "AuthTypeKerberos" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "kerberos" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "entialsForKerberosHasInvalidUserName" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "n.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "#GSS_Kerberosv5_AP_REQ1510" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "rberos-token-profile-1.1#Kerberosv5APREQSHA1" (Indicator: "kerberos"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")4a:T726,Found registry query API: "RegQueryValueW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegOpenKeyExW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegQueryValueExW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegEnumValueW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegQueryInfoKeyA" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegSaveKeyW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegQueryInfoKeyW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegEnumKeyExW" in file "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin" Found registry query API: "RegQueryValueExW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegQueryValueW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002024.00000001.183088.72211000.00000002.mdmp"4b:T50b,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "d__11" (Indicator: "GetUserName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetUserNameCredentialAsync" (Indicator: "GetUserName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetUserNameTokenProvider" (Indicator: "GetUserName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "WSystem.ServiceModel.Channels.TransportSecurityHelpers+d__11" (Indicator: "GetUserName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")4c:Tfd4,Found string "AeS@N" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "EmptyBase64Attribute" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "base64Binary" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes128-cbc" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes128-cbc" (Indicator: "aes128"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes192-cbc" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes192-cbc" (Indicator: "aes192"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes256-cbc" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://www.w3.org/2001/04/xmlenc#aes256-cbc" (Indicator: "aes256"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WSAESTALE" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WSAESHUTDOWN" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WSAESOCKTNOSUPPORT" (Indicator: "aes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "Too much data for base64 line" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "O&:a2b_base64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "y*|$i:b2a_base64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "a2b_base64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "b2a_base64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "a2b_base64($module, data, /)--Decode a line of base64 data." (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "b2a_base64($module, /, data, *, newline=True)--Base64-code line of data." (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") file/memory contains long string with (Indicator: "zipfile"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "kECDSA" (Indicator: "ecdsa"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "AShared.EncryptionFunc" (Indicator: ".encrypt"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "ChaCha20" (Indicator: "chacha"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "WriteBase64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "ReadValueAsBase64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found string "ReadContentAsBase64" (Indicator: "base64"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin")4d:Tb44,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetCurrentProcess($module, /)--Return a handle object for the current process." (Indicator: "GetCurrentProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")4e:Tb6a,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")4f:T4b0,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "k:GetModuleFileName" (Indicator: "GetModuleFileName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") file/memory contains long string with (Indicator: "GetModuleFileName"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "k:GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")50:Tf12,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000372.00000000.183004.007E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000664.00000000.183002.02E70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000680.00000000.189113.007F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000780.00000001.192333.00760000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001548.00000001.184604.033D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001796.00000000.183414.032A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001796.00000000.183414.032A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002024.00000001.183088.00830000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002024.00000001.183088.00830000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002024.00000001.183088.00830000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002300.00000000.194588.034E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002300.00000000.194588.034E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002620.00000001.193060.031A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002620.00000001.193060.031A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002792.00000001.186535.00910000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002792.00000001.186535.00910000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002792.00000001.186535.00910000.00000004.mdmp")51:T72c,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "kI:TerminateProcess" (Indicator: "TerminateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "I:ExitProcess" (Indicator: "ExitProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "TerminateProcess($module, handle, exit_code, /)--Terminate the specified process and all of its threads." (Indicator: "TerminateProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "ExitProcess($module, ExitCode, /)--" (Indicator: "ExitProcess"; File: "3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin") Found reference to API "I:ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "kI:TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002024.00000001.183088.72211000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003968.00000001.186542.00A99000.00000002.mdmp")52:Ta94,"Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00000664.00000000.183002.03440000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00000664.00000000.183002.03440000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00000680.00000000.189113.02CD0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00000680.00000000.189113.02CD0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00000780.00000000.190729.02C50000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00000780.00000000.190729.02C50000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00001796.00000000.183414.039A0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00001796.00000000.183414.039A0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002300.00000000.194588.039A0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00002300.00000000.194588.039A0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002620.00000000.191456.037C0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00002620.00000000.191456.037C0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002792.00000000.184934.02FA0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00002792.00000000.184934.02FA0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003136.00000000.192661.03810000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00003136.00000000.192661.03810000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004088.00000000.186873.039A0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00004088.00000000.186873.039A0000.00000002.mdmp "Shell_TrayWnd" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00004980.00000000.187273.034B0000.00000002.mdmp "Progman" (Program manager) in Source: 00000000-00004980.00000000.187273.034B0000.00000002.mdmp53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==5f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==60:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==61:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==62:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==63:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==64:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==65:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==66:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==67:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==68:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==69:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==6f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==71:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==73:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==74:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==75:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==76:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==77:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==78:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==79:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==7f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==80:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==81:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==82:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==83:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==84:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==85:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==86:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==87:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==88:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==89:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==8a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAADMzMzMzMzMzMzMzMzMAAAAzMzMzMzMzMzMzMzMzMAAAO7u7szMzMzMzMzMzMzMAADu7u7u7u7szMzMzMzMzMAA7u7u7u7u7MzMzMzMzMzMAO7u7u7u7u7szMzMzMzMzMDu7u7u7u7u7szMzMzMzMzM7u7u7u7u7u7szMzMzMzMzO7u7u7u7u7u7MzMzMzMzMzu7u7u7u7u7u7szMzMzMzM7u7u7u7u7u7u7szMzMzMzO7u7u7u7u7u7u7szMzMzMzu7u7u7u7u7u7u7MzMzMzM7u7u7u7u7u7u7uzMzMzMzMzMzM3d3d3d3d3d3MzMzMzMwAACIiId3d4dmZnMzMzMDMAAAiIiIiHiIeHAAMzMzADAAAIiIiIiIiHhwAAMzMwAAAAB3j/h4iIh4cAADMzMAGZmREY/////4h3AAAzMzABmZmZeP////94AAABMzMwAZmZkXeP//+HhwAAAzMzMAGZmZkXd4iHd3AAABMzMzABmZmZERd3d3AAAAAzMzMwAZmZmZEREQAAAAdzMzMzAAGRGZmZEREQAAAHMzMzMAADMzMZmZEREAAHczMzMwAAMzMzMxERERAHczMzMzAAADMzMzMzMRERMzMzMzMAAAAzMzMzMzMzMzMzMzMwAAAAMzMzMzMzMzMzMzMzAAAAD/////AAAAPwAAAB8AAAAPAAAABwAAAAMAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAewAAAPAAAAHgAAAD4AAAB+AAAA/gAAA/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":82,"unified_at_epoch_ms":1791242620052,"unified_at":"2026-10-05T23:23:40.052Z","metadata":{"hashes":{"sha256":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead","sha1":"edd7dfcef1faa59873cd47f2a4b56929f5b953d7","md5":"5cddfdf258c1fdbc01ca98bf7a7980e2","sha512":"37f7888743fc316973d8c300c61d137d3915e5e584b352de28d2910d17fbff37aaef294bd918d05f237534a30f797a802eb073c2ad7ab3bcb8d4f96d2f9cb80e","ssdeep":"98304:5fTr8oo9MLKbZqoqn6r4FHlMZsky5ZXoFumfoMG333p333YGOA4WtSc4hqDDu:5n8oo5RvZTvoCKtSc4AW","ssdeep_chunks":["98304:5fTr8oo","98304:fTr8oo9","98304:Tr8oo9M","98304:r8oo9ML","98304:8oo9MLK","98304:oo9MLKb","98304:o9MLKbZ","98304:9MLKbZq","98304:MLKbZqo","98304:LKbZqoq","98304:KbZqoqn","98304:bZqoqn6","98304:Zqoqn6r","98304:qoqn6r4","98304:oqn6r4F","98304:qn6r4FH","98304:n6r4FHl","98304:6r4FHlM","98304:r4FHlMZ","98304:4FHlMZs","98304:FHlMZsk","98304:HlMZsky","98304:lMZsky5","98304:MZsky5Z","98304:Zsky5ZX","98304:sky5ZXo","98304:ky5ZXoF","98304:y5ZXoFu","98304:5ZXoFum","98304:ZXoFumf","98304:XoFumfo","98304:oFumfoM","98304:FumfoMG","98304:umfoMG3","98304:mfoMG33","98304:foMG333","98304:oMG333p","98304:MG333p3","98304:G333p33","98304:333p333","98304:33p333Y","98304:3p333YG","98304:p333YGO","98304:333YGOA","98304:33YGOA4","98304:3YGOA4W","98304:YGOA4Wt","98304:GOA4WtS","98304:OA4WtSc","98304:A4WtSc4","98304:4WtSc4h","98304:WtSc4hq","98304:tSc4hqD","98304:Sc4hqDD","98304:c4hqDDu","196608:5fTr8oo","196608:fTr8oo9","196608:Tr8oo9M","196608:r8oo9ML","196608:8oo9MLK","196608:oo9MLKb","196608:o9MLKbZ","196608:9MLKbZq","196608:MLKbZqo","196608:LKbZqoq","196608:KbZqoqn","196608:bZqoqn6","196608:Zqoqn6r","196608:qoqn6r4","196608:oqn6r4F","196608:qn6r4FH","196608:n6r4FHl","196608:6r4FHlM","196608:r4FHlMZ","196608:4FHlMZs","196608:FHlMZsk","196608:HlMZsky","196608:lMZsky5","196608:MZsky5Z","196608:Zsky5ZX","196608:sky5ZXo","196608:ky5ZXoF","196608:y5ZXoFu","196608:5ZXoFum","196608:ZXoFumf","196608:XoFumfo","196608:oFumfoM","196608:FumfoMG","196608:umfoMG3","196608:mfoMG33","196608:foMG333","196608:oMG333p","196608:MG333p3","196608:G333p33","196608:333p333","196608:33p333Y","196608:3p333YG","196608:p333YGO","196608:333YGOA","196608:33YGOA4","196608:3YGOA4W","196608:YGOA4Wt","196608:GOA4WtS","196608:OA4WtSc","196608:A4WtSc4","196608:4WtSc4h","196608:WtSc4hq","196608:tSc4hqD","196608:Sc4hqDD","196608:c4hqDDu","98304:5n8oo5R","98304:n8oo5Rv","98304:8oo5RvZ","98304:oo5RvZT","98304:o5RvZTv","98304:5RvZTvo","98304:RvZTvoC","98304:vZTvoCK","98304:ZTvoCKt","98304:TvoCKtS","98304:voCKtSc","98304:oCKtSc4","98304:CKtSc4A","98304:KtSc4AW"],"imphash":"a90609ee973c8ba5f091fd392ba83911"},"file_info":{"file_name":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","file_type":["pedll","executable"],"file_type_id":"dll","file_size":7192168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776378020000,"last_seen":1776378027000,"last_multi_scan":1776378027000}},"detections":{"summary":{"verdict":"malicious","score":82,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":64},"sandbox_signatures":{"informative_count":159,"suspicious_count":15,"malicious_count":1,"total":175},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.ACRStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Loader.Ropalidia.CV.gen trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Infostealer/ACRStealer","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"Able to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match – Cryptographic hashing algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\#\\&\\)\\+\\\n\\.\\0\\2\\5\\6\\Y\\Z\\\\\\b\\c\\g\\h\\i\\m\\p\\t\\u\\z\\{\\|\\}\\; Source: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string - \\#\\&\\)\\+\\\n\\.\\0\\2\\5\\6\\Y\\Z\\\\\\b\\c\\g\\h\\i\\m\\p\\t\\u\\z\\{\\|\\}\\; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$2c","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found api reference \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found api reference \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002300.00000000.194588.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.Xml.RSACryptoServiceProvider._cachedDecryptedBodyContentReader\" in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.Xml.RSACryptoServiceProvider.requiresEncryptedFormReader\" in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.Xml.Aes192Encryption.WrappedKeyDecryption\" in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\n Observed string: \"System.Security.Cryptography.X509Certificates.Aes128KeyWrap.CreateDecryptor\" in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/dotnet/wcf\" (Indicator: \"github.com\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00003320.00000001.194262.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"d__6\" (Indicator: \"sendmessage\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"OnConnectionSendMessageAsync\" (Indicator: \"sendmessage\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SendMessageChannelCacheMiss\" (Indicator: \"sendmessage\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"HttpSendMessageStart\" (Indicator: \"sendmessage\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"gSystem.ServiceModel.Channels.ReliableOutputSessionChannelOverRequest+d__6\" (Indicator: \"sendmessage\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001548)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002024)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000372)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000664)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001796)\n \"WerFault.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008116)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002792)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007888)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.dll at 10881-1413-1E17E7D0\n GetTickCount64@KERNEL32.dll at 10881-1416-1E17E790\n GetTickCount64@KERNEL32.dll at 10881-11639-1E0876C0\n GetTickCount64@KERNEL32.dll at 10881-11711-1E081F60\n GetTickCount64@KERNEL32.dll at 10881-12767-1E029290","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 10881-11829-1E06D150\n FindFirstFileW@KERNEL32.dll at 10881-11843-1E06C620\n FindFirstFileW@KERNEL32.dll at 10881-11859-1E06B8C0\n FindFirstFileW@KERNEL32.dll at 10881-11866-1E070B60\n FindNextFileW@KERNEL32.dll at 10881-11873-1E070937\n FindFirstFileW@KERNEL32.dll at 10881-11911-1E06B7A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 10881-1413-1E17E7D0\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-1419-1E17E640\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-12233-1E052630\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-12767-1E029290\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-13700-1E06D3C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 10881-1413-1E17E7D0\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-1419-1E17E640\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-12233-1E052630\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-12767-1E029290\n GetSystemTimeAsFileTime@KERNEL32.dll at 10881-13700-1E06D3C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 10881-11107-1E0B3B20\n GetVersion@KERNEL32.dll at 10881-11131-1E0B2510\n GetVersionExA@KERNEL32.dll at 10881-14487-1E19A480","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 10881-11889-1E06FA40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WerFault.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetSystemTimeAsFileTime()\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetCreationTimeChars\" (Indicator: \"GetCreationTime\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetSystemTimeAsFileTime()\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 10881-11782-1E072DE0\n GetSystemInfo@KERNEL32.dll at 10881-12002-1E0650E0\n GetSystemInfo@KERNEL32.dll at 10881-12003-1E0650C0\n GetSystemInfo@KERNEL32.dll at 10881-13641-1E0668D0\n GetSystemInfo@KERNEL32.dll at 10881-13703-1E06FE10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver be thrown.\" (Indicator: \"ver \") in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 10881-815-1E19CEB0\n GetProcessHeap@KERNEL32.dll at 10881-9759-1E19CE80\n OpenProcess@KERNEL32.dll at 10881-11130-1E0B2540\n OpenProcessToken@ADVAPI32.dll at 10881-11140-1E0B2D40\n OpenProcessToken@ADVAPI32.dll at 10881-11775-1E073030\n OpenProcess@KERNEL32.dll at 10881-11819-1E06E5A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"jne 1E0B252Eh\" at 10881-11131-1E0B2510","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry modification API: \"RegLoadKeyW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry modification API: \"RegCreateKeyW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\build\\cpython36\\PCBuild\\win32\\python36.pdb\"\n \"/_/artifacts/obj/System.Private.ServiceModel/Release/netstandard2.0/System.Private.ServiceModel.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.dll at 10881-11117-1E0B3000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.dll at 10881-9762-1E19CC00\n WaitForSingleObject@KERNEL32.dll at 10881-11123-1E0B4240\n WaitForMultipleObjects@KERNEL32.dll at 10881-11125-1E0B3FF0\n WaitForSingleObjectEx@KERNEL32.dll at 10881-11355-1E09B8A0\n WaitForSingleObjectEx@KERNEL32.dll at 10881-11639-1E0876C0\n WaitForSingleObjectEx@KERNEL32.dll at 10881-14439-1E155220\n WaitForSingleObjectEx@KERNEL32.dll at 10881-14440-1E1552D0\n WaitForSingleObjectEx@KERNEL32.dll at 10881-14491-1E19CB50\n WaitForSingleObjectEx@KERNEL32.dll at 10881-17038-1E19CBA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"RegDisableReflectionKey\" (Indicator: \"RegDisableReflectionKey\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"RegDisableReflectionKey\" (Indicator: \"RegDisableReflectionKey\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 10881-9847-1E168620\n LoadLibraryExW@KERNEL32.dll at 10881-9850-1E1455A0\n LoadLibraryW@KERNEL32.dll at 10881-11787-1E06FB00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3e","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\\" in Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\n \"Software\\Python\\PythonCore\\\" in Source: 00000000-00002024.00000001.183088.72211000.00000002.mdmp\n \"WindowsRegistryFinderz>Meta path finder for modules declared in the Windows registry.z;Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}zASoftware\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\DebugFc\" in Source: 00000000-00002024.00000001.183088.72211000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"WerFault.exe\" created multiple process\n \"rundll32.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"y@ymyqydy.zp\"\n Pattern match: \"6h@fo.lwft\"\n Pattern match: \"a.r@a.rda.rha.rla.rpa.rta\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"WindowsRegistryFinderz>Meta path finder for modules declared in the Windows registry.z;Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}zASoftware\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\DebugFc\" in Source: 00000000-00002024.00000001.183088.72211000.00000002.mdmp\n \"Software\\Python\\PythonCore\\\" in Source: 00000000-00002024.00000001.183088.72211000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/dotnet/wcf\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73C20000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72D00000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73C20000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72D00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 739A0000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 739A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1e19f18d,call\t0x1e19f588,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1e19f050,add\tesp, 0xc,pop\tebp,ret\t0xc,push\tebp,mov\tebp, esp,mov\teax, dword ptr [0x1e2a9004],mov\tecx, eax,xor\teax, dword ptr [ebp + 8],and\tecx, 0x1f,ror\teax, cl,pop\tebp,ret\t,push\tebp,mov\tebp, esp,mov\teax, dword ptr [0x1e2a9004],and\teax, 0x1f,push\t0x20,pop\tecx,sub\tecx, eax,mov\teax, dword ptr [ebp + 8],ror\teax, cl,xor\teax, dword ptr [0x1e2a9004],pop\tebp,ret\t,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],mov\tecx, dword ptr [ebp + 0xc],ror\teax, cl,pop\tebp,ret\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x19f400\" greater than 0x100000\n Raw size of \".rdata\" is \"0x107800\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x348400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x19f31a\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x107686\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x3482fc\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00001548) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00001548) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$43","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceChannel\" (Indicator: \"CreateService\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CreateServiceHostStop\" (Indicator: \"CreateService\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"CreateServiceHostStart\" (Indicator: \"CreateService\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 10881-11820-1E072350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 1548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VERSION.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VERSION.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n file/memory contains long string with (Indicator: \" connect \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"maxheap variant of heappop.\" [Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"2.5.29.17\"\n \"4.10.3.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000372.00000000.183004.007E0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000664.00000000.183002.02E70000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000680.00000000.189113.007F0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000780.00000001.192333.00760000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00001548.00000001.184604.033D0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00001796.00000000.183414.032A0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002024.00000001.183088.00830000.00000004.mdmp\")\n Found URL \"http://python.org/dev/peps/pep-0263/\" - Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$49","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WerFault.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetTickCount64()\" (Indicator: \"GetTickCount\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"GetTickCount64()\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"%Scheme \"%s\" already registered for %s$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented\" (Indicator: \"password\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"_password\" (Indicator: \"password\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"_secret\" (Indicator: \"secret\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostName\" (Indicator: \"hostname\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format specifier missing precision\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"Format specifier must be a string, not %.200s\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"format requires a mapping\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"Format string contains positional fields\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"format %y requires year >= 1900 on Windows\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found string \"format -> strftime() style string.\" (Indicator: \"format \"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n file/memory contains long string with (Indicator: \"SeBackupPrivilege\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002024.00000001.183088.72211000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003968.00000001.186542.00A99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has section name .reloc with entropy \"7.8412182872584895\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"WerFault.exe queries ProcessDebugPort (UID: 8116)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"General","name":"Able to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 10881-11140-1E0B2D40\n DeviceIoControl@KERNEL32.dll at 10881-11861-1E06B200\n DeviceIoControl@KERNEL32.dll at 10881-13701-1E06E7B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":5,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 10881-11140-1E0B2D40\n CreateDirectoryW@KERNEL32.dll at 10881-11836-1E06CE80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has resource with unusual entropy \"VCLSTYLE:7.952144347186828\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has resource with unusual entropy \"VCLSTYLE:7.942019467453576\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has resource with unusual entropy \"RT_RCDATA:7.931386784798308\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has resource with unusual entropy \"RT_RCDATA:7.907206684492146\"\n \"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" has resource with unusual entropy \"RT_RCDATA:7.892028463012284\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"$52","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Cryptographic hashing algorithm","description":"YARA signature match for cryptographic hashing algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-173","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 10881-11896-1E06E500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 10881-11108-1E0B3A00\n GetModuleFileNameW@KERNEL32.dll at 10881-14487-1E19A480","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 10881-11829-1E06D150\n RemoveDirectoryW@KERNEL32.dll at 10881-11832-1E06D030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueA@ADVAPI32.dll at 10881-11140-1E0B2D40\n LookupPrivilegeValueA@ADVAPI32.dll at 10881-11775-1E073030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.dll at 10881-11112-1E0B3980\n TerminateProcess@KERNEL32.dll at 10881-11127-1E0B26D0\n TerminateProcess@KERNEL32.dll at 10881-11819-1E06E5A0\n ExitProcess@KERNEL32.dll at 10881-13967-1E0B2340","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin\" claimed CRC 7204177 while the actual is CRC 7235539","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExW\n RegDeleteValueW\n OpenProcessToken\n RegDeleteKeyW\n GetUserNameW\n RegCloseKey\n RegCreateKeyExW\n RegEnumKeyExW\n RegCreateKeyW\n FindNextFileW\n WriteFile\n GetTickCount\n OpenProcess\n GetFileAttributesExW\n GetModuleHandleW\n GetModuleHandleA\n GetSystemInfo\n GetFileSize\n OutputDebugStringW\n DeviceIoControl\n GetVersionExA\n ConnectNamedPipe\n Sleep\n CreateProcessW\n Process32First\n GetFileAttributesW\n GetModuleFileNameW\n CreateDirectoryW\n CreateFileMappingA\n CreateFileA\n GetStartupInfoW\n TerminateProcess\n GetTickCount64\n UnhandledExceptionFilter\n LoadLibraryW\n Process32Next\n CreateToolhelp32Snapshot\n VirtualAlloc\n CreateFileW\n MapViewOfFile\n IsDebuggerPresent\n FindFirstFileW\n LoadLibraryExW\n DeleteFileW\n GetProcAddress\n send","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections\n 3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable for MS Windows 4.00 (DLL)\n Intel i386 Mono/.Net assembly\n 3 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]}]},"activity":{"stats":{"process_count":138,"spawned_processes_count":138,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"69e160aadc0e03b1b20f3a2a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"Loader.Ropalidia.CV","submit_name":"3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin","analysis_start_time":"2026-04-16T22:20:28+00:00","indicators_count":{"informative":159,"suspicious":24,"malicious":1},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}],"processes":[{"pid":3648,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003648"},{"pid":1548,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001548","icon":"$53"},{"pid":8060,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00008060"},{"pid":4340,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00004340"},{"pid":4344,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00004344"},{"pid":2024,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002024","icon":"$54"},{"pid":1192,"ppid":2024,"name":"WerFault.exe","command_line":"-u -p 2024 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002024","uid":"00000000-00001192"},{"pid":6832,"ppid":2024,"name":"WerFault.exe","command_line":"-u -p 2024 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002024","uid":"00000000-00006832"},{"pid":5644,"ppid":2024,"name":"WerFault.exe","command_line":"-u -p 2024 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002024","uid":"00000000-00005644"},{"pid":372,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000372","icon":"$55"},{"pid":7580,"ppid":372,"name":"WerFault.exe","command_line":"-u -p 372 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000372","uid":"00000000-00007580"},{"pid":6824,"ppid":372,"name":"WerFault.exe","command_line":"-u -p 372 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000372","uid":"00000000-00006824"},{"pid":7524,"ppid":372,"name":"WerFault.exe","command_line":"-u -p 372 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000372","uid":"00000000-00007524"},{"pid":664,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000664","icon":"$56"},{"pid":4288,"ppid":664,"name":"WerFault.exe","command_line":"-u -p 664 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000664","uid":"00000000-00004288"},{"pid":5756,"ppid":664,"name":"WerFault.exe","command_line":"-u -p 664 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000664","uid":"00000000-00005756"},{"pid":6764,"ppid":664,"name":"WerFault.exe","command_line":"-u -p 664 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000664","uid":"00000000-00006764"},{"pid":6140,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 372 -ip 372","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006140","icon":"$57"},{"pid":7640,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 2024 -ip 2024","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007640","icon":"$58"},{"pid":1724,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 664 -ip 664","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001724","icon":"$59"},{"pid":3056,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 456 -p 1548 -ip 1548","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003056","icon":"$5a"},{"pid":1796,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001796","icon":"$5b"},{"pid":8116,"ppid":1796,"name":"WerFault.exe","command_line":"-u -p 1796 -s 688","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001796","uid":"00000000-00008116"},{"pid":3312,"ppid":8116,"name":"WerFault.exe","command_line":"-u -p 8116 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008116","uid":"00000000-00003312"},{"pid":2888,"ppid":8116,"name":"WerFault.exe","command_line":"-u -p 8116 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008116","uid":"00000000-00002888"},{"pid":4140,"ppid":8116,"name":"WerFault.exe","command_line":"-u -p 8116 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008116","uid":"00000000-00004140"},{"pid":3168,"ppid":1796,"name":"WerFault.exe","command_line":"-u -p 1796 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001796","uid":"00000000-00003168"},{"pid":3664,"ppid":1796,"name":"WerFault.exe","command_line":"-u -p 1796 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001796","uid":"00000000-00003664"},{"pid":5476,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 1796 -ip 1796","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005476","icon":"$5c"},{"pid":2792,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002792","icon":"$5d"},{"pid":2016,"ppid":2792,"name":"WerFault.exe","command_line":"-u -p 2792 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002792","uid":"00000000-00002016"},{"pid":532,"ppid":2792,"name":"WerFault.exe","command_line":"-u -p 2792 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002792","uid":"00000000-00000532"},{"pid":7680,"ppid":2792,"name":"WerFault.exe","command_line":"-u -p 2792 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002792","uid":"00000000-00007680"},{"pid":7888,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007888","icon":"$5e"},{"pid":7736,"ppid":7888,"name":"WerFault.exe","command_line":"-u -p 7888 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007888","uid":"00000000-00007736"},{"pid":7672,"ppid":7888,"name":"WerFault.exe","command_line":"-u -p 7888 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007888","uid":"00000000-00007672"},{"pid":6192,"ppid":7888,"name":"WerFault.exe","command_line":"-u -p 7888 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007888","uid":"00000000-00006192"},{"pid":3968,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003968","icon":"$5f"},{"pid":7980,"ppid":3968,"name":"WerFault.exe","command_line":"-u -p 3968 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003968","uid":"00000000-00007980"},{"pid":6260,"ppid":3968,"name":"WerFault.exe","command_line":"-u -p 3968 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003968","uid":"00000000-00006260"},{"pid":6080,"ppid":3968,"name":"WerFault.exe","command_line":"-u -p 3968 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003968","uid":"00000000-00006080"},{"pid":7720,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 560 -p 7888 -ip 7888","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007720","icon":"$60"},{"pid":4312,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 560 -p 2792 -ip 2792","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004312","icon":"$61"},{"pid":4572,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 3968 -ip 3968","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004572","icon":"$62"},{"pid":5676,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#9","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005676","icon":"$63"},{"pid":6212,"ppid":5676,"name":"WerFault.exe","command_line":"-u -p 5676 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005676","uid":"00000000-00006212"},{"pid":4508,"ppid":5676,"name":"WerFault.exe","command_line":"-u -p 5676 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005676","uid":"00000000-00004508"},{"pid":1008,"ppid":5676,"name":"WerFault.exe","command_line":"-u -p 5676 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005676","uid":"00000000-00001008"},{"pid":976,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 456 -p 5676 -ip 5676","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000976","icon":"$64"},{"pid":7104,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#10","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007104","icon":"$65"},{"pid":7440,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#11","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007440","icon":"$66"},{"pid":6884,"ppid":7440,"name":"WerFault.exe","command_line":"-u -p 7440 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007440","uid":"00000000-00006884"},{"pid":700,"ppid":7440,"name":"WerFault.exe","command_line":"-u -p 7440 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007440","uid":"00000000-00000700"},{"pid":2044,"ppid":7440,"name":"WerFault.exe","command_line":"-u -p 7440 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007440","uid":"00000000-00002044"},{"pid":4088,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#12","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004088","icon":"$67"},{"pid":3948,"ppid":4088,"name":"WerFault.exe","command_line":"-u -p 4088 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004088","uid":"00000000-00003948"},{"pid":6976,"ppid":4088,"name":"WerFault.exe","command_line":"-u -p 4088 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004088","uid":"00000000-00006976"},{"pid":2500,"ppid":4088,"name":"WerFault.exe","command_line":"-u -p 4088 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004088","uid":"00000000-00002500"},{"pid":6656,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 7440 -ip 7440","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006656","icon":"$68"},{"pid":6252,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 420 -p 4088 -ip 4088","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006252","icon":"$69"},{"pid":5996,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#13","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005996","icon":"$6a"},{"pid":1764,"ppid":5996,"name":"WerFault.exe","command_line":"-u -p 5996 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005996","uid":"00000000-00001764"},{"pid":2832,"ppid":5996,"name":"WerFault.exe","command_line":"-u -p 5996 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005996","uid":"00000000-00002832"},{"pid":4380,"ppid":5996,"name":"WerFault.exe","command_line":"-u -p 5996 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005996","uid":"00000000-00004380"},{"pid":8024,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 420 -p 5996 -ip 5996","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008024","icon":"$6b"},{"pid":4980,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#14","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004980","icon":"$6c"},{"pid":8100,"ppid":4980,"name":"WerFault.exe","command_line":"-u -p 4980 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004980","uid":"00000000-00008100"},{"pid":1644,"ppid":4980,"name":"WerFault.exe","command_line":"-u -p 4980 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004980","uid":"00000000-00001644"},{"pid":5000,"ppid":4980,"name":"WerFault.exe","command_line":"-u -p 4980 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004980","uid":"00000000-00005000"},{"pid":6848,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 4980 -ip 4980","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006848","icon":"$6d"},{"pid":6360,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#15","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006360","icon":"$6e"},{"pid":5896,"ppid":6360,"name":"WerFault.exe","command_line":"-u -p 6360 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006360","uid":"00000000-00005896"},{"pid":8036,"ppid":6360,"name":"WerFault.exe","command_line":"-u -p 6360 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006360","uid":"00000000-00008036"},{"pid":4172,"ppid":6360,"name":"WerFault.exe","command_line":"-u -p 6360 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006360","uid":"00000000-00004172"},{"pid":6120,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#16","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006120","icon":"$6f"},{"pid":4240,"ppid":6120,"name":"WerFault.exe","command_line":"-u -p 6120 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006120","uid":"00000000-00004240"},{"pid":6464,"ppid":6120,"name":"WerFault.exe","command_line":"-u -p 6120 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006120","uid":"00000000-00006464"},{"pid":7336,"ppid":6120,"name":"WerFault.exe","command_line":"-u -p 6120 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006120","uid":"00000000-00007336"},{"pid":3500,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 6360 -ip 6360","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003500","icon":"$70"},{"pid":5436,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 456 -p 6120 -ip 6120","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005436","icon":"$71"},{"pid":680,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#17","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000680","icon":"$72"},{"pid":5616,"ppid":680,"name":"WerFault.exe","command_line":"-u -p 680 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000680","uid":"00000000-00005616"},{"pid":5984,"ppid":680,"name":"WerFault.exe","command_line":"-u -p 680 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000680","uid":"00000000-00005984"},{"pid":4616,"ppid":680,"name":"WerFault.exe","command_line":"-u -p 680 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000680","uid":"00000000-00004616"},{"pid":1328,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 680 -ip 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001328","icon":"$73"},{"pid":6108,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#18","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006108","icon":"$74"},{"pid":5384,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#19","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005384","icon":"$75"},{"pid":1300,"ppid":5384,"name":"WerFault.exe","command_line":"-u -p 5384 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005384","uid":"00000000-00001300"},{"pid":7228,"ppid":5384,"name":"WerFault.exe","command_line":"-u -p 5384 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005384","uid":"00000000-00007228"},{"pid":7792,"ppid":5384,"name":"WerFault.exe","command_line":"-u -p 5384 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005384","uid":"00000000-00007792"},{"pid":4028,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 5384 -ip 5384","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004028","icon":"$76"},{"pid":780,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#20","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000780","icon":"$77"},{"pid":2516,"ppid":780,"name":"WerFault.exe","command_line":"-u -p 780 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000780","uid":"00000000-00002516"},{"pid":6636,"ppid":780,"name":"WerFault.exe","command_line":"-u -p 780 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000780","uid":"00000000-00006636"},{"pid":4192,"ppid":780,"name":"WerFault.exe","command_line":"-u -p 780 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000780","uid":"00000000-00004192"},{"pid":5912,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#21","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005912","icon":"$78"},{"pid":5176,"ppid":5912,"name":"WerFault.exe","command_line":"-u -p 5912 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005912","uid":"00000000-00005176"},{"pid":2384,"ppid":5912,"name":"WerFault.exe","command_line":"-u -p 5912 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005912","uid":"00000000-00002384"},{"pid":4212,"ppid":5912,"name":"WerFault.exe","command_line":"-u -p 5912 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005912","uid":"00000000-00004212"},{"pid":2224,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 572 -p 5912 -ip 5912","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002224","icon":"$79"},{"pid":6060,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 780 -ip 780","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006060","icon":"$7a"},{"pid":4964,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#22","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004964","icon":"$7b"},{"pid":6816,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#23","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006816","icon":"$7c"},{"pid":1088,"ppid":6816,"name":"WerFault.exe","command_line":"-u -p 6816 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006816","uid":"00000000-00001088"},{"pid":8056,"ppid":6816,"name":"WerFault.exe","command_line":"-u -p 6816 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006816","uid":"00000000-00008056"},{"pid":7972,"ppid":6816,"name":"WerFault.exe","command_line":"-u -p 6816 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006816","uid":"00000000-00007972"},{"pid":1864,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 6816 -ip 6816","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001864","icon":"$7d"},{"pid":2620,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#24","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002620","icon":"$7e"},{"pid":5576,"ppid":2620,"name":"WerFault.exe","command_line":"-u -p 2620 -s 692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002620","uid":"00000000-00005576"},{"pid":1720,"ppid":2620,"name":"WerFault.exe","command_line":"-u -p 2620 -s 692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002620","uid":"00000000-00001720"},{"pid":2268,"ppid":2620,"name":"WerFault.exe","command_line":"-u -p 2620 -s 692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002620","uid":"00000000-00002268"},{"pid":4376,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 420 -p 2620 -ip 2620","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004376","icon":"$7f"},{"pid":3320,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#25","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003320","icon":"$80"},{"pid":8156,"ppid":3320,"name":"WerFault.exe","command_line":"-u -p 3320 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003320","uid":"00000000-00008156"},{"pid":6772,"ppid":3320,"name":"WerFault.exe","command_line":"-u -p 3320 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003320","uid":"00000000-00006772"},{"pid":6608,"ppid":3320,"name":"WerFault.exe","command_line":"-u -p 3320 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003320","uid":"00000000-00006608"},{"pid":3136,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#26","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003136","icon":"$81"},{"pid":164,"ppid":3136,"name":"WerFault.exe","command_line":"-u -p 3136 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003136","uid":"00000000-00000164"},{"pid":6524,"ppid":3136,"name":"WerFault.exe","command_line":"-u -p 3136 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003136","uid":"00000000-00006524"},{"pid":7624,"ppid":3136,"name":"WerFault.exe","command_line":"-u -p 3136 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003136","uid":"00000000-00007624"},{"pid":2160,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 572 -p 3320 -ip 3320","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002160","icon":"$82"},{"pid":7796,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 420 -p 3136 -ip 3136","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007796","icon":"$83"},{"pid":1140,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 8116 -ip 8116","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001140","icon":"$84"},{"pid":6284,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#28","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006284","icon":"$85"},{"pid":1684,"ppid":6284,"name":"WerFault.exe","command_line":"-u -p 6284 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006284","uid":"00000000-00001684"},{"pid":4636,"ppid":6284,"name":"WerFault.exe","command_line":"-u -p 6284 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006284","uid":"00000000-00004636"},{"pid":7728,"ppid":6284,"name":"WerFault.exe","command_line":"-u -p 6284 -s 688","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006284","uid":"00000000-00007728"},{"pid":4280,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 6284 -ip 6284","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004280","icon":"$86"},{"pid":2300,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#29","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002300","icon":"$87"},{"pid":392,"ppid":2300,"name":"WerFault.exe","command_line":"-u -p 2300 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002300","uid":"00000000-00000392"},{"pid":5660,"ppid":2300,"name":"WerFault.exe","command_line":"-u -p 2300 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002300","uid":"00000000-00005660"},{"pid":32,"ppid":2300,"name":"WerFault.exe","command_line":"-u -p 2300 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002300","uid":"00000000-00000032"},{"pid":7416,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll\",#30","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007416","icon":"$88"},{"pid":6124,"ppid":7416,"name":"WerFault.exe","command_line":"-u -p 7416 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007416","uid":"00000000-00006124"},{"pid":5944,"ppid":7416,"name":"WerFault.exe","command_line":"-u -p 7416 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007416","uid":"00000000-00005944"},{"pid":3040,"ppid":7416,"name":"WerFault.exe","command_line":"-u -p 7416 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007416","uid":"00000000-00003040"},{"pid":1048,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 2300 -ip 2300","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001048","icon":"$89"},{"pid":1500,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 7416 -ip 7416","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001500","icon":"$8a"}],"all_imported_dlls":["msvcp_win.dll","cfgmgr32.dll","SHCore.dll","rpcrt4.dll","windows.storage.dll","powrprof.dll","user32.dll","ucrtbase.dll","shell32.dll","bcryptprimitives.dll","setupapi.dll","mpr.dll","IPHLPAPI.DLL","sfc_os.dll","ntdll.dll","wow64.dll","wow64cpu.dll","gdi32full.dll","cryptbase.dll","profapi.dll","sfc.dll","fltLib.dll","KernelBase.dll","sechost.dll","combase.dll","advapi32.dll","VxSSL32.dll","ws2_32.dll","3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead.bin.dll","version.dll","wow64win.dll","kernel.appcore.dll","imagehlp.dll","uxtheme.dll","dwmapi.dll","win32u.dll","gdi32.dll","oleaut32.dll","bcrypt.dll","cryptsp.dll","sspicli.dll","imm32.dll","vcruntime140.dll","msctf.dll","kernel32.dll","AcLayers.dll","shlwapi.dll","ole32.dll","apphelp.dll","msvcrt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e160aadc0e03b1b20f3a2a"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69e160aadc0e03b1b20f3a2a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Infostealer/ACRStealer Sample 3442ef237e4b… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3442ef237e4b…. Malware family: Infostealer/ACRStealer. Threat score 82/100. 3/27 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead"}],["$","meta","4",{"property":"og:title","content":"Malicious Infostealer/ACRStealer Sample 3442ef237e4b… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3442ef237e4b…. Malware family: Infostealer/ACRStealer. Threat score 82/100. 3/27 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3442ef237e4be9b964e7922253482cdbe557d9c8c44c519ea6fecf1725cdeead"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Infostealer/ACRStealer Sample 3442ef237e4b… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3442ef237e4b…. Malware family: Infostealer/ACRStealer. Threat score 82/100. 3/27 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8b","11",{}]]