26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Downloader.Agent.Win64 Sample 628b3d1725dd… — Score 77/100 — Hybrid Analysis","description":"Malicious verdict for sample 628b3d1725dd…. Malware family: Downloader.Agent.Win64. Threat score 77/100. 2/27 AV engines flagged this file. 0 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879","keywords":["Malicious","Downloader.Agent.Win64","malware analysis","sandbox report","threat intelligence","628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879"],"about":{"@type":"SoftwareApplication","name":"Zxl.dll","applicationCategory":["pedll","executable"],"identifier":"628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879","additionalType":"Malicious sample"},"threatScore":77,"malwareFamily":"Downloader.Agent.Win64","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T798,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Zxl.dll") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Zxl.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Zxl.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Zxl.dll") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Zxl.dll") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Zxl.dll") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Zxl.dll") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Zxl.dll") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Zxl.dll") Found reference to API "Failure from WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Zxl.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp")28:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00007232-00000C15-1097538575 [PID: 7232] "rundll32.exe" queried SystemProcessInformation at 00000000-00007232-00000C15-1097557924 [PID: 7232] "rundll32.exe" queried SystemProcessInformation at 00000000-00007232-00000C15-1098006072 [PID: 7232] "rundll32.exe" queried SystemProcessInformation at 00000000-00007232-00000C15-1098072876 [PID: 7232] "rundll32.exe" queried SystemProcessInformation at 00000000-00006380-00000C15-1097670069 [PID: 6380] "rundll32.exe" queried SystemProcessInformation at 00000000-00006380-00000C15-1097716674 [PID: 6380] "rundll32.exe" queried SystemProcessInformation at 00000000-00006380-00000C15-1098141994 [PID: 6380] "rundll32.exe" queried SystemProcessInformation at 00000000-00006380-00000C15-1098174027 [PID: 6380] "rundll32.exe" queried SystemProcessInformation at 00000000-00006676-00000C15-1097709181 [PID: 6676] "rundll32.exe" queried SystemProcessInformation at 00000000-00006676-00000C15-1097757564 [PID: 6676] "rundll32.exe" queried SystemProcessInformation at 00000000-00006676-00000C15-1098252520 [PID: 6676] "rundll32.exe" queried SystemProcessInformation at 00000000-00006676-00000C15-1098288644 [PID: 6676] "rundll32.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-1097714941 [PID: 7452] "rundll32.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-1097762887 [PID: 7452] "rundll32.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-1098295940 [PID: 7452] "rundll32.exe" queried SystemProcessInformation at 00000000-00007452-00000C15-1098345031 [PID: 7452] "rundll32.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1105666308 [PID: 7288] "rundll32.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1105683527 [PID: 7288] "rundll32.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1105919661 [PID: 7288] "rundll32.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1105945108 [PID: 7288] "rundll32.exe" queried SystemProcessInformation at 00000000-00001508-00000C15-1109004128 [PID: 1508] "rundll32.exe" queried SystemProcessInformation at 00000000-00001508-00000C15-1109011777 [PID: 1508] "rundll32.exe" queried SystemProcessInformation at 00000000-00001508-00000C15-1109197174 [PID: 1508] "rundll32.exe" queried SystemProcessInformation at 00000000-00001508-00000C15-1109206103 [PID: 1508] "rundll32.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-1112190751 [PID: 7572]29:T5ce,Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "Zxl.dll") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "Zxl.dll") Found api reference "CryptVerifyDetachedMessageSignature" (Indicator: "CryptVerifyDetachedMessageSignature"; File: "Zxl.dll") Found api reference "CryptGetMessageCertificates" (Indicator: "CryptGetMessageCertificates"; File: "Zxl.dll") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "Zxl.dll") Found api reference "CertVerifySubjectCertificateContext" (Indicator: "CertVerifySubjectCertificateContext"; File: "Zxl.dll") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "Zxl.dll") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "Zxl.dll") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "Zxl.dll") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; File: "Zxl.dll") Found api reference "CryptSignMessage" (Indicator: "CryptSignMessage"; File: "Zxl.dll") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "Zxl.dll") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "Zxl.dll") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "Zxl.dll")2a:Tf30,Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 38878-12-1072A868 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 38878-12-1072A868 Assembly shows XOR instruction xor bh cl in Stream UID: 38878-12-1072A868 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-928-10289730 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-928-10289730 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3665-10652E20 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3683-106524E0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3685-106517D0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3686-10651330 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3686-10651330 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3753-1064F090 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3753-1064F090 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3755-1064ED50 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3755-1064ED50 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3853-10648540 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3853-10648540 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3854-10648400 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3854-10648400 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3858-10648360 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3858-10648360 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3859-106481C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3859-106481C0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3862-10647D60 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3862-10647D60 Assembly shows XOR instruction xor byte ptr [esp+eax*4+00h] dh in Stream UID: 38878-3863-10647BE0 Assembly shows XOR instruction xor byte ptr [esp+eax*4+00h] bh in Stream UID: 38878-3863-10647BE0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3864-10647830 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3864-10647830 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3992-105F9730 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3992-105F9730 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-3993-105F95D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-3993-105F95D0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4050-105F8980 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4050-105F8980 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4085-105F7B60 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4085-105F7B60 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4203-105CD220 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4203-105CD220 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4205-105CD1C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4205-105CD1C0 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4206-105CD160 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4206-105CD160 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4207-105CD100 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4207-105CD100 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4208-105CCF10 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4208-105CCF10 Assembly shows XOR instruction xor eax esp in Stream UID: 38878-4210-105CCD30 Assembly shows XOR instruction xor ecx esp in Stream UID: 38878-4210-105CCD302b:T6d7b,Found XOR loop in file "sample.bin" at offset 1050616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1050936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2234725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2235176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2235615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2236041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2236473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2236962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2237422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2237863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2238311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2238759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2240601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2241033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2241468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2241897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4239043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6271772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6271872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7612657; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7702908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7716759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8371180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8424776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8424952; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8424980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8425708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8425880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8425908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8438920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8530460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8713688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8722088; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9157656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9157756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9232730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9239547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9243617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9246269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9254173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9257533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9261015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9262121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9263423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9278155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9295079; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9311097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9317037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9319371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9322689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9334681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9336339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9336769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9338619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9346565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9347663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9355829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9366059; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9370683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9372281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9373913; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9394821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9400233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9404857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9409561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9411021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9425593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9427285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9430267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9430865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9437031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9439179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9441097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9441793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9443623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9445475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9447177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9449179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9451821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9452151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9453931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9454703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9457301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9458139; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9462897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9463699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9467215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9469703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9470717; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9473863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9477025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9477547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9478661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9480537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9480971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9485589; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9486123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9487725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9490543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9492091; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9493219; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9493747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9494711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9495701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9496175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9497631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9498205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9499247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9499693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9500713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9502529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9503071; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9503991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9508291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 253186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 282896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 590173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 590598; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 810845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 857331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1466364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1466523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1467500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1467659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1468622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1468779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1469900; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1470059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1659431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2060263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2060272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2060277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2060304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3388170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3388200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3533849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3691218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3691404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3691491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3691577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3693589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3694387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3694477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3694566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4167708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4167734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4172966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4173970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4300582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4407473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4407977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4408021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4420173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4420417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4487763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4661817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4662958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4664774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4665568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4665855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4668560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4668631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4695512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4726686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5093126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5150949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5194384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5196693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5256189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258130; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5258575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5386818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6972532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6975460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7058633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7077806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7208117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7208122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7263660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7263905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7335482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9214824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9240135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9242539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9242855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9250381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9266801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9268167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9275117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9302179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9325063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9344675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9349983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9354015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9359793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9373117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9376335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9392461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9393947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9408953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9423283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 298116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 312634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 322155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 689378; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 740155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1261444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2104473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2105255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2974813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2974845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3175440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3175538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3286317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4620596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4621054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5240202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5254733; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5572785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7496420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7496811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7780798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7786389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7786845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7786985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7790151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7793259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7793879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7794254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8027206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8082634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8226024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8277280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8485520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8563549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8563565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9199385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9203251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9209747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9209883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9227354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9236548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9243578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9257076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9263146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9280274; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9281062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9282108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9291848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9308654; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9309870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9313625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9325536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9341864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9350132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9352602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9355802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9362050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9369612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9373486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9382216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9393392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9396172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9405922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9407084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9408652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9411616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9411980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9419390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9425564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9427246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9428848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9430228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9436992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9441060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9441760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9443584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9445436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9447138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9449140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9449874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9451814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9452144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9453916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9455546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9456522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9457286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9458126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9458986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9460558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9462882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9463684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9464516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9466206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9468648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9469190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9469694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9470704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9471738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9472754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9474920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9479876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9483504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9485106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9487254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9488280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9488806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9489822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9490524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9495214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9497592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9498634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9499208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9500368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9501234; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9502204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9502492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9503032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9503952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9508280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9586920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9589656; code bytes = 80302c:T604,"rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007232) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00007232) "rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00006380) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00006380) "rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00006676) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00006676) "rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007452) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00007452) "rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007288) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00007288) "rundll32.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00001508) "rundll32.exe" called "GetWindowTextW" with parameter "There was a problem starting C:\Zxl.dllThe specified module could not be found." - (UID: 00000000-00001508)2d:T408,"rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007232) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006380) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006676) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007452) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007288) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001508) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007572) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004216) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001488) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005560) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00002288)2e:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007232) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006380) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006676) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007452) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001508) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007572) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004216) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001488) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002288) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003144) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003416) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008092) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005684) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004716) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006180) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006544) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000404) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007172) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005880) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006976) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001760) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006740) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007724)2f:T396a,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007232) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007232) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007232) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007232) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006380) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006676) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007288) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001508) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001508) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001508) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001508) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007572) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007572) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007572) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007572) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004216) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004216) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004216) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004216) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001488) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001488) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001488) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001488) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005560) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005560) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005560) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005560) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003144) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003416) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003416) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003416) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003416) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008092) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008092) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008092) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008092) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005684) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005684) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005684) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005684) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004716) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004716) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004716) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004716) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006180) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006180) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006180) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006180) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006544) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006544) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006544) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006544) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000404) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000404) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000404) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000404) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007172) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007172) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007172) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007172) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005880) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005880) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005880) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005880) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006976) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001760) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001760) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001760) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001760) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006740) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007724) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007724) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007724) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007724) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006076) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003520) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003520) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003520) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003520) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007992) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007992) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007992) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007992) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001300) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000896) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000896) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003704) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003704) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003704) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003704) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006468) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006952) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003636) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003636) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003636) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003636) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007032) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007032) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007032) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007032)30:T11ad,"DELETE FROM CatKeywordsAncestry" (Source: 38878-5545-10205900, Indicator: "delete from catkeywordsancestry") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid" (Source: 38878-5776-106E69D0, Indicator: "select name, rootpage, sql from '%q'.%s where %s order by rowid") "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 38878-6184-106D1B00, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s ORDER BY rowid" (Source: 38878-6184-106D1B00, Indicator: "select name rootpage sql from '%q'.%s order by rowid"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 38878-6202-106BA050, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 38878-6284-106C1110, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q AND type='index'" (Source: 38878-6303-106C3040, Indicator: "delete from %q.%s where name=%q and type='index'"), "UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 38878-6304-1068D610, Indicator: "update %q.%s set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 38878-6305-106BF760, Indicator: "delete from %q.%s where %s=%q"), "INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 38878-6330-106C8170, Indicator: "insert into %q.%s values('trigger',%q,%q,0,'create trigger %q')"), "CREATE TABLE %Q.%s(%s)" (Source: 38878-6350-106ABF30, Indicator: "create table %q.%s(%s)"), "UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" (Source: 38878-6352-106B9CD0, Indicator: "update "%w".%s set sql = sqlite_rename_parent(sql, %q, %q) where %s;"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 38878-6352-106B9CD0, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q) tbl_name = %Q WHERE %s;" (Source: 38878-6352-106B9CD0, Indicator: "update sqlite_temp_master set sql = sqlite_rename_trigger(sql, %q) tbl_name = %q where %s;"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 38878-6359-106B9A00, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 38878-6362-106EFF90, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "UPDATE CatConfig SET CC_KeywordsVersionCookie=? WHERE CC_ID=1" (Source: 38878-6460-102083E0, Indicator: "update catconfig set cc_keywordsversioncookie=? where cc_id=1"), "INSERT INTO CatKeywordsAncestry (CK_ID, CK_AncestorID,CK_Hierarchy) VALUES(?,?,?)" (Source: 38878-6610-10206160, Indicator: "insert into catkeywordsancestry (ck_id, ck_ancestorid,ck_hierarchy) values(?,?,?)"), "SELECT CK_ID FROM CatKeywords WHERE CK_KeywordNormalized=?" (Source: 38878-6611-10205E90, Indicator: "select ck_id from catkeywords where ck_keywordnormalized=?"), "UPDATE CatKeywords SET CK_Known=1 CK_Keyword=? WHERE CK_ID=?" (Source: 38878-6611-10205E90, Indicator: "update catkeywords set ck_known=1 ck_keyword=? where ck_id=?"), "INSERT INTO CatKeywords (CK_KeywordNormalized, CK_Keyword, CK_Known) VALUES(?,?,1)" (Source: 38878-6611-10205E90, Indicator: "insert into catkeywords (ck_keywordnormalized, ck_keyword, ck_known) values(?,?,1)"), "SELECT CC_MasterVersion CC_IndexInstanceCookie CC_ConfigVersion CC_ActiveTokenizer CC_RepositoryLimit CC_KeywordsVersionCookie FROM CatConfig WHERE CC_ID=1" (Source: 38878-6616-10203CE0, Indicator: "select cc_masterversion cc_indexinstancecookie cc_configversion cc_activetokenizer cc_repositorylimit cc_keywordsversioncookie from catconfig where cc_id=1"), "UPDATE CatConfig SET CC_MasterVersion=? CC_ConfigVersion=? CC_ActiveTokenizer=? CC_RepositoryLimit=? WHERE CC_ID=1" (Source: 38878-6647-10208090, Indicator: "update catconfig set cc_masterversion=? cc_configversion=? cc_activetokenizer=? cc_repositorylimit=? where cc_id=1"), "SELECT CC_ConfigVersion FROM CatConfig WHERE CC_ID=1" (Source: 38878-6692-10204BD0, Indicator: "select cc_configversion from catconfig where cc_id=1"), "DELETE FROM CatConfigFolders" (Source: 38878-6693-10207EC0, Indicator: "delete from catconfigfolders")31:T1339,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "Zxl.dll") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp")32:T549,WaitForSingleObject@KERNEL32.dll at 38878-4860-1057E0F0 WaitForSingleObject@KERNEL32.dll at 38878-5153-10529730 WaitForSingleObject@KERNEL32.dll at 38878-5156-10529420 Sleep@KERNEL32.dll at 38878-5353-103DE990 Sleep@KERNEL32.dll at 38878-5354-103DE8E0 WaitForSingleObject@KERNEL32.dll at 38878-5357-103DE6C0 WaitForSingleObject@KERNEL32.dll at 38878-6939-103B2C20 WaitForSingleObject@KERNEL32.dll at 38878-7172-103A9380 Sleep@KERNEL32.dll at 38878-9262-102737F0 WaitForSingleObject@KERNEL32.dll at 38878-9665-1024BAB0 WaitForMultipleObjects@KERNEL32.dll at 38878-27331-1066AF30 Sleep@KERNEL32.dll at 38878-27337-106680D0 WaitForSingleObject@KERNEL32.dll at 38878-27339-106679A0 Sleep@KERNEL32.dll at 38878-28545-105F36B0 SetTimer at 38878-29809-1053F4A0 WaitForMultipleObjects@KERNEL32.dll at 38878-30754-104B2640 WaitForMultipleObjects@KERNEL32.dll at 38878-31076-104708B0 WaitForSingleObject@KERNEL32.dll at 38878-31711-104148F0 WaitForSingleObject@KERNEL32.dll at 38878-32006-103E7FF0 WaitForSingleObject@KERNEL32.dll at 38878-32013-103E6A9A WaitForSingleObject@KERNEL32.dll at 38878-32015-103E58B0 WaitForSingleObject@KERNEL32.dll at 38878-32185-103B2820 WaitForSingleObject@KERNEL32.dll at 38878-32282-103CA8F0 WaitForSingleObject@KERNEL32.dll at 38878-32288-103C8DE0 WaitForSingleObject@KERNEL32.dll at 38878-32394-103B3E5033:Ta46f,Found reference to API (Indicator: "RegSetValueExA"; File: "Zxl.dll") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Zxl.dll") Found reference to API (Indicator: "RegQueryValueExW"; File: "Zxl.dll") Found reference to API (Indicator: "RegDeleteValueW"; File: "Zxl.dll") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Zxl.dll") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Zxl.dll") Found reference to API (Indicator: "RegEnumKeyExW"; File: "Zxl.dll") Found reference to API (Indicator: "RegEnumValueA"; File: "Zxl.dll") Found reference to API (Indicator: "RegSetValueExW"; File: "Zxl.dll") Found reference to API (Indicator: "RegDeleteKeyA"; File: "Zxl.dll") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Zxl.dll") Found reference to API (Indicator: "OpenProcessToken"; File: "Zxl.dll") Found reference to API (Indicator: "RegEnumKeyExA"; File: "Zxl.dll") Found reference to API (Indicator: "CredFree"; File: "Zxl.dll") Found reference to API (Indicator: "RegEnumKeyW"; File: "Zxl.dll") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Zxl.dll") Found reference to API (Indicator: "IsTextUnicode"; File: "Zxl.dll") Found reference to API (Indicator: "RegCloseKey"; File: "Zxl.dll") Found reference to API (Indicator: "RegDeleteValueA"; File: "Zxl.dll") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Zxl.dll") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "Zxl.dll") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Zxl.dll") Found reference to API (Indicator: "RegEnumValueW"; File: "Zxl.dll") Found reference to API (Indicator: "RegQueryValueExA"; File: "Zxl.dll") Found reference to API (Indicator: "GetSaveFileNameW"; File: "Zxl.dll") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; File: "Zxl.dll") Found reference to API (Indicator: "CryptVerifyDetachedMessageSignature"; File: "Zxl.dll") Found reference to API (Indicator: "CryptGetMessageCertificates"; File: "Zxl.dll") Found reference to API (Indicator: "CertGetCertificateChain"; File: "Zxl.dll") Found reference to API (Indicator: "CertVerifySubjectCertificateContext"; File: "Zxl.dll") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; File: "Zxl.dll") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "Zxl.dll") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "Zxl.dll") Found reference to API (Indicator: "CryptDecodeObject"; File: "Zxl.dll") Found reference to API (Indicator: "CryptSignMessage"; File: "Zxl.dll") Found reference to API (Indicator: "CertOpenStore"; File: "Zxl.dll") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "Zxl.dll") Found reference to API (Indicator: "CertCloseStore"; File: "Zxl.dll") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Zxl.dll") Found reference to API (Indicator: "RoundRect"; File: "Zxl.dll") Found reference to API (Indicator: "SelectObject"; File: "Zxl.dll") Found reference to API (Indicator: "TextOutA"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentObject"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteDC"; File: "Zxl.dll") Found reference to API (Indicator: "CreateSolidBrush"; File: "Zxl.dll") Found reference to API (Indicator: "SetMapMode"; File: "Zxl.dll") Found reference to API (Indicator: "GetStockObject"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteObject"; File: "Zxl.dll") Found reference to API (Indicator: "GetDIBits"; File: "Zxl.dll") Found reference to API (Indicator: "BitBlt"; File: "Zxl.dll") Found reference to API (Indicator: "SetStretchBltMode"; File: "Zxl.dll") Found reference to API (Indicator: "GetDeviceCaps"; File: "Zxl.dll") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "Zxl.dll") Found reference to API (Indicator: "GetTextColor"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFontA"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFontIndirectA"; File: "Zxl.dll") Found reference to API (Indicator: "StretchBlt"; File: "Zxl.dll") Found reference to API (Indicator: "ExtTextOutA"; File: "Zxl.dll") Found reference to API (Indicator: "GetObjectW"; File: "Zxl.dll") Found reference to API (Indicator: "CreatePatternBrush"; File: "Zxl.dll") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "Zxl.dll") Found reference to API (Indicator: "lstrcmpW"; File: "Zxl.dll") Found reference to API (Indicator: "PeekNamedPipe"; File: "Zxl.dll") Found reference to API (Indicator: "GetTempPathA"; File: "Zxl.dll") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalFree"; File: "Zxl.dll") Found reference to API (Indicator: "CancelIo"; File: "Zxl.dll") Found reference to API (Indicator: "GetTimeFormatW"; File: "Zxl.dll") Found reference to API (Indicator: "MapViewOfFile"; File: "Zxl.dll") Found reference to API (Indicator: "GetLastError"; File: "Zxl.dll") Found reference to API (Indicator: "GetDriveTypeW"; File: "Zxl.dll") Found reference to API (Indicator: "OutputDebugStringA"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalReAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalLock"; File: "Zxl.dll") Found reference to API (Indicator: "TlsGetValue"; File: "Zxl.dll") Found reference to API (Indicator: "UnmapViewOfFile"; File: "Zxl.dll") Found reference to API (Indicator: "GetLocalTime"; File: "Zxl.dll") Found reference to API (Indicator: "GetSystemTime"; File: "Zxl.dll") Found reference to API (Indicator: "ResetEvent"; File: "Zxl.dll") Found reference to API (Indicator: "FindResourceA"; File: "Zxl.dll") Found reference to API (Indicator: "GetModuleHandleA"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "Zxl.dll") Found reference to API (Indicator: "WinExec"; File: "Zxl.dll") Found reference to API (Indicator: "GetDateFormatW"; File: "Zxl.dll") Found reference to API (Indicator: "GetFullPathNameA"; File: "Zxl.dll") Found reference to API (Indicator: "SetErrorMode"; File: "Zxl.dll") Found reference to API (Indicator: "EncodePointer"; File: "Zxl.dll") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Zxl.dll") Found reference to API (Indicator: "GetShortPathNameW"; File: "Zxl.dll") Found reference to API (Indicator: "InitializeSListHead"; File: "Zxl.dll") Found reference to API (Indicator: "CompareFileTime"; File: "Zxl.dll") Found reference to API (Indicator: "GetLongPathNameW"; File: "Zxl.dll") Found reference to API (Indicator: "CloseHandle"; File: "Zxl.dll") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Zxl.dll") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Zxl.dll") Found reference to API (Indicator: "LockResource"; File: "Zxl.dll") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "Zxl.dll") Found reference to API (Indicator: "GetSystemInfo"; File: "Zxl.dll") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "Zxl.dll") Found reference to API (Indicator: "GetModuleHandleW"; File: "Zxl.dll") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Zxl.dll") Found reference to API (Indicator: "MoveFileExW"; File: "Zxl.dll") Found reference to API (Indicator: "GetThreadPriority"; File: "Zxl.dll") Found reference to API (Indicator: "GetACP"; File: "Zxl.dll") Found reference to API (Indicator: "GetTempFileNameA"; File: "Zxl.dll") Found reference to API (Indicator: "WaitForSingleObject"; File: "Zxl.dll") Found reference to API (Indicator: "LoadLibraryW"; File: "Zxl.dll") Found reference to API (Indicator: "TlsAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "FindFirstFileW"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFileA"; File: "Zxl.dll") Found reference to API (Indicator: "CreateSemaphoreW"; File: "Zxl.dll") Found reference to API (Indicator: "lstrcpyA"; File: "Zxl.dll") Found reference to API (Indicator: "GetExitCodeThread"; File: "Zxl.dll") Found reference to API (Indicator: "lstrlenW"; File: "Zxl.dll") Found reference to API (Indicator: "EnumResourceNamesA"; File: "Zxl.dll") Found reference to API (Indicator: "DuplicateHandle"; File: "Zxl.dll") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileSizeEx"; File: "Zxl.dll") Found reference to API (Indicator: "OpenFileMappingW"; File: "Zxl.dll") Found reference to API (Indicator: "SetFilePointerEx"; File: "Zxl.dll") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Zxl.dll") Found reference to API (Indicator: "LoadLibraryA"; File: "Zxl.dll") Found reference to API (Indicator: "HeapReAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "Zxl.dll") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Zxl.dll") Found reference to API (Indicator: "EnterCriticalSection"; File: "Zxl.dll") Found reference to API (Indicator: "GetLogicalDrives"; File: "Zxl.dll") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Zxl.dll") Found reference to API (Indicator: "SetThreadPriority"; File: "Zxl.dll") Found reference to API (Indicator: "GetVersionExW"; File: "Zxl.dll") Found reference to API (Indicator: "TerminateProcess"; File: "Zxl.dll") Found reference to API (Indicator: "FreeLibrary"; File: "Zxl.dll") Found reference to API (Indicator: "HeapDestroy"; File: "Zxl.dll") Found reference to API (Indicator: "HeapAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFileMappingW"; File: "Zxl.dll") Found reference to API (Indicator: "FindNextChangeNotification"; File: "Zxl.dll") Found reference to API (Indicator: "HeapCompact"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalHandle"; File: "Zxl.dll") Found reference to API (Indicator: "ReadDirectoryChangesW"; File: "Zxl.dll") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "Zxl.dll") Found reference to API (Indicator: "OpenMutexW"; File: "Zxl.dll") Found reference to API (Indicator: "CopyFileW"; File: "Zxl.dll") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Zxl.dll") Found reference to API (Indicator: "MulDiv"; File: "Zxl.dll") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedCompareExchange64"; File: "Zxl.dll") Found reference to API (Indicator: "GetTempFileNameW"; File: "Zxl.dll") Found reference to API (Indicator: "GetVolumeInformationW"; File: "Zxl.dll") Found reference to API (Indicator: "GetTickCount"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentThread"; File: "Zxl.dll") Found reference to API (Indicator: "ReleaseSemaphore"; File: "Zxl.dll") Found reference to API (Indicator: "FindNextFileW"; File: "Zxl.dll") Found reference to API (Indicator: "VirtualQuery"; File: "Zxl.dll") Found reference to API (Indicator: "lstrcmpiW"; File: "Zxl.dll") Found reference to API (Indicator: "FormatMessageA"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteFileA"; File: "Zxl.dll") Found reference to API (Indicator: "CreateSemaphoreA"; File: "Zxl.dll") Found reference to API (Indicator: "GetFullPathNameW"; File: "Zxl.dll") Found reference to API (Indicator: "ReleaseMutex"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedExchange"; File: "Zxl.dll") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "Zxl.dll") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedIncrement"; File: "Zxl.dll") Found reference to API (Indicator: "ResumeThread"; File: "Zxl.dll") Found reference to API (Indicator: "SetFileTime"; File: "Zxl.dll") Found reference to API (Indicator: "OpenProcess"; File: "Zxl.dll") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Zxl.dll") Found reference to API (Indicator: "LocalFree"; File: "Zxl.dll") Found reference to API (Indicator: "AreFileApisANSI"; File: "Zxl.dll") Found reference to API (Indicator: "GetProcessHeap"; File: "Zxl.dll") Found reference to API (Indicator: "FatalAppExitW"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Zxl.dll") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "Zxl.dll") Found reference to API (Indicator: "FindResourceW"; File: "Zxl.dll") Found reference to API (Indicator: "LocalAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "Zxl.dll") Found reference to API (Indicator: "FindCloseChangeNotification"; File: "Zxl.dll") Found reference to API (Indicator: "HeapSize"; File: "Zxl.dll") Found reference to API (Indicator: "HeapFree"; File: "Zxl.dll") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "Zxl.dll") Found reference to API (Indicator: "SetEndOfFile"; File: "Zxl.dll") Found reference to API (Indicator: "GetProcAddress"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedDecrement"; File: "Zxl.dll") Found reference to API (Indicator: "IsBadCodePtr"; File: "Zxl.dll") Found reference to API (Indicator: "LoadResource"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Zxl.dll") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Zxl.dll") Found reference to API (Indicator: "FindFirstFileExW"; File: "Zxl.dll") Found reference to API (Indicator: "SetFileAttributesW"; File: "Zxl.dll") Found reference to API (Indicator: "UnlockFile"; File: "Zxl.dll") Found reference to API (Indicator: "CreateMutexW"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileAttributesA"; File: "Zxl.dll") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "Zxl.dll") Found reference to API (Indicator: "SetFilePointer"; File: "Zxl.dll") Found reference to API (Indicator: "WriteFile"; File: "Zxl.dll") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "Zxl.dll") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "Zxl.dll") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Zxl.dll") Found reference to API (Indicator: "ReadFile"; File: "Zxl.dll") Found reference to API (Indicator: "FlushViewOfFile"; File: "Zxl.dll") Found reference to API (Indicator: "GetLocaleInfoA"; File: "Zxl.dll") Found reference to API (Indicator: "GetVersionExA"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalUnlock"; File: "Zxl.dll") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Zxl.dll") Found reference to API (Indicator: "Sleep"; File: "Zxl.dll") Found reference to API (Indicator: "DecodePointer"; File: "Zxl.dll") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "Zxl.dll") Found reference to API (Indicator: "TlsFree"; File: "Zxl.dll") Found reference to API (Indicator: "UnlockFileEx"; File: "Zxl.dll") Found reference to API (Indicator: "FindClose"; File: "Zxl.dll") Found reference to API (Indicator: "DeviceIoControl"; File: "Zxl.dll") Found reference to API (Indicator: "TlsSetValue"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentProcess"; File: "Zxl.dll") Found reference to API (Indicator: "CreateThread"; File: "Zxl.dll") Found reference to API (Indicator: "CreateProcessW"; File: "Zxl.dll") Found reference to API (Indicator: "CreateDirectoryW"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedFlushSList"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileAttributesExW"; File: "Zxl.dll") Found reference to API (Indicator: "IsValidCodePage"; File: "Zxl.dll") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Zxl.dll") Found reference to API (Indicator: "OpenFile"; File: "Zxl.dll") Found reference to API (Indicator: "HeapCreate"; File: "Zxl.dll") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "Zxl.dll") Found reference to API (Indicator: "HeapValidate"; File: "Zxl.dll") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "Zxl.dll") Found reference to API (Indicator: "FormatMessageW"; File: "Zxl.dll") Found reference to API (Indicator: "OutputDebugStringW"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "ExitProcess"; File: "Zxl.dll") Found reference to API (Indicator: "GetTempPathW"; File: "Zxl.dll") Found reference to API (Indicator: "ReplaceFileW"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileAttributesW"; File: "Zxl.dll") Found reference to API (Indicator: "SetEvent"; File: "Zxl.dll") Found reference to API (Indicator: "GetStdHandle"; File: "Zxl.dll") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFileMappingA"; File: "Zxl.dll") Found reference to API (Indicator: "CreatePipe"; File: "Zxl.dll") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Zxl.dll") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteFileW"; File: "Zxl.dll") Found reference to API (Indicator: "CreateEventW"; File: "Zxl.dll") Found reference to API (Indicator: "CompareStringW"; File: "Zxl.dll") Found reference to API (Indicator: "MoveFileW"; File: "Zxl.dll") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Zxl.dll") Found reference to API (Indicator: "SizeofResource"; File: "Zxl.dll") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFileW"; File: "Zxl.dll") Found reference to API (Indicator: "LockFile"; File: "Zxl.dll") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Zxl.dll") Found reference to API (Indicator: "LockFileEx"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileSize"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalFlags"; File: "Zxl.dll") Found reference to API (Indicator: "FindFirstFileA"; File: "Zxl.dll") Found reference to API (Indicator: "TerminateThread"; File: "Zxl.dll") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "Zxl.dll") Found reference to API (Indicator: "lstrcpynW"; File: "Zxl.dll") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; File: "Zxl.dll") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Zxl.dll") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Zxl.dll") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "Zxl.dll") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Zxl.dll") Found reference to API (Indicator: "FlushFileBuffers"; File: "Zxl.dll") Found reference to API (Indicator: "GlobalSize"; File: "Zxl.dll") Found reference to API (Indicator: "FindNextFileA"; File: "Zxl.dll") Found reference to API (Indicator: "SysAllocString"; File: "Zxl.dll") Found reference to API (Indicator: "SysReAllocStringLen"; File: "Zxl.dll") Found reference to API (Indicator: "SysFreeString"; File: "Zxl.dll") Found reference to API (Indicator: "SysStringLen"; File: "Zxl.dll") Found reference to API (Indicator: "SysAllocStringLen"; File: "Zxl.dll") Found reference to API (Indicator: "UuidToStringW"; File: "Zxl.dll") Found reference to API (Indicator: "RpcStringFreeW"; File: "Zxl.dll") Found reference to API (Indicator: "SetupDiOpenDevRegKey"; File: "Zxl.dll") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailW"; File: "Zxl.dll") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "Zxl.dll") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "Zxl.dll") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Zxl.dll") Found reference to API (Indicator: "SHFileOperationW"; File: "Zxl.dll") Found reference to API (Indicator: "ShellExecuteW"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetMalloc"; File: "Zxl.dll") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Zxl.dll") Found reference to API (Indicator: "PathCanonicalizeW"; File: "Zxl.dll") Found reference to API (Indicator: "MessageBoxW"; File: "Zxl.dll") Found reference to API (Indicator: "InsertMenuItemA"; File: "Zxl.dll") Found reference to API (Indicator: "SetRect"; File: "Zxl.dll") Found reference to API (Indicator: "DispatchMessageW"; File: "Zxl.dll") Found reference to API (Indicator: "CharLowerBuffW"; File: "Zxl.dll") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "CharLowerA"; File: "Zxl.dll") Found reference to API (Indicator: "RegisterClassW"; File: "Zxl.dll") Found reference to API (Indicator: "CharUpperW"; File: "Zxl.dll") Found reference to API (Indicator: "GetCursorPos"; File: "Zxl.dll") Found reference to API (Indicator: "GetFocus"; File: "Zxl.dll") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "MessageBoxA"; File: "Zxl.dll") Found reference to API (Indicator: "CharLowerW"; File: "Zxl.dll") Found reference to API (Indicator: "KillTimer"; File: "Zxl.dll") Found reference to API (Indicator: "CharToOemA"; File: "Zxl.dll") Found reference to API (Indicator: "PtInRect"; File: "Zxl.dll") Found reference to API (Indicator: "GetCapture"; File: "Zxl.dll") Found reference to API (Indicator: "OpenClipboard"; File: "Zxl.dll") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "Zxl.dll") Found reference to API (Indicator: "GetKeyboardLayout"; File: "Zxl.dll") Found reference to API (Indicator: "GetSystemMetrics"; File: "Zxl.dll") Found reference to API (Indicator: "GetScrollInfo"; File: "Zxl.dll") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "Zxl.dll") Found reference to API (Indicator: "ReleaseDC"; File: "Zxl.dll") Found reference to API (Indicator: "wsprintfA"; File: "Zxl.dll") Found reference to API (Indicator: "SetScrollPos"; File: "Zxl.dll") Found reference to API (Indicator: "SetScrollInfo"; File: "Zxl.dll") Found reference to API (Indicator: "LoadCursorW"; File: "Zxl.dll") Found reference to API (Indicator: "DefWindowProcW"; File: "Zxl.dll") Found reference to API (Indicator: "PostQuitMessage"; File: "Zxl.dll") Found reference to API (Indicator: "GetDesktopWindow"; File: "Zxl.dll") Found reference to API (Indicator: "DestroyWindow"; File: "Zxl.dll") Found reference to API (Indicator: "IsWindow"; File: "Zxl.dll") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "Zxl.dll") Found reference to API (Indicator: "CharUpperBuffW"; File: "Zxl.dll") Found reference to API (Indicator: "SetClipboardData"; File: "Zxl.dll") Found reference to API (Indicator: "SetTimer"; File: "Zxl.dll") Found reference to API (Indicator: "CharUpperA"; File: "Zxl.dll") Found reference to API (Indicator: "CloseClipboard"; File: "Zxl.dll") Found reference to API (Indicator: "SetWindowPlacement"; File: "Zxl.dll") Found reference to API (Indicator: "GetClientRect"; File: "Zxl.dll") Found reference to API (Indicator: "GetKeyState"; File: "Zxl.dll") Found reference to API (Indicator: "OemToCharA"; File: "Zxl.dll") Found reference to API (Indicator: "DeleteMenu"; File: "Zxl.dll") Found reference to API (Indicator: "CreatePopupMenu"; File: "Zxl.dll") Found reference to API (Indicator: "EmptyClipboard"; File: "Zxl.dll") Found reference to API (Indicator: "DestroyCursor"; File: "Zxl.dll") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "Zxl.dll") Found reference to API (Indicator: "wsprintfW"; File: "Zxl.dll") Found reference to API (Indicator: "SetCursor"; File: "Zxl.dll") Found reference to API (Indicator: "PeekMessageW"; File: "Zxl.dll") Found reference to API (Indicator: "ClientToScreen"; File: "Zxl.dll") Found reference to API (Indicator: "ScreenToClient"; File: "Zxl.dll") Found reference to API (Indicator: "GetMenuItemCount"; File: "Zxl.dll") Found reference to API (Indicator: "TranslateMessage"; File: "Zxl.dll") Found reference to API (Indicator: "MessageBeep"; File: "Zxl.dll") Found reference to API (Indicator: "GetDC"; File: "Zxl.dll") Found reference to API (Indicator: "WindowFromPoint"; File: "Zxl.dll") Found reference to API (Indicator: "LoadStringW"; File: "Zxl.dll") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "Zxl.dll") Found reference to API (Indicator: "SendMessageA"; File: "Zxl.dll") Found reference to API (Indicator: "IntersectRect"; File: "Zxl.dll") Found reference to API (Indicator: "GetWindowPlacement"; File: "Zxl.dll") Found reference to API (Indicator: "CreateWindowExW"; File: "Zxl.dll") Found reference to API (Indicator: "LoadStringA"; File: "Zxl.dll") Found reference to API (Indicator: "ReleaseCapture"; File: "Zxl.dll") Found reference to API (Indicator: "SetCapture"; File: "Zxl.dll") Found reference to API (Indicator: "GetSysColor"; File: "Zxl.dll") Found reference to API (Indicator: "OffsetRect"; File: "Zxl.dll") Found reference to API (Indicator: "GetAsyncKeyState"; File: "Zxl.dll") Found reference to API (Indicator: "CallNextHookEx"; File: "Zxl.dll") Found reference to API (Indicator: "EnumWindows"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Zxl.dll") Found reference to API (Indicator: "VerQueryValueW"; File: "Zxl.dll") Found reference to API (Indicator: "HttpEndRequestW"; File: "Zxl.dll") Found reference to API (Indicator: "InternetConnectW"; File: "Zxl.dll") Found reference to API (Indicator: "InternetWriteFile"; File: "Zxl.dll") Found reference to API (Indicator: "InternetErrorDlg"; File: "Zxl.dll") Found reference to API (Indicator: "InternetSetOptionW"; File: "Zxl.dll") Found reference to API (Indicator: "HttpQueryInfoW"; File: "Zxl.dll") Found reference to API (Indicator: "HttpSendRequestW"; File: "Zxl.dll") Found reference to API (Indicator: "HttpOpenRequestW"; File: "Zxl.dll") Found reference to API (Indicator: "HttpSendRequestExW"; File: "Zxl.dll") Found reference to API (Indicator: "InternetCloseHandle"; File: "Zxl.dll") Found reference to API (Indicator: "HttpAddRequestHeadersW"; File: "Zxl.dll") Found reference to API (Indicator: "InternetOpenW"; File: "Zxl.dll") Found reference to API (Indicator: "InternetReadFile"; File: "Zxl.dll") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "Zxl.dll") Found reference to API (Indicator: "htons"; File: "Zxl.dll") Found reference to API (Indicator: "ntohs"; File: "Zxl.dll") Found reference to API (Indicator: "RtlFirstEntrySList"; File: "Zxl.dll") Found reference to API (Indicator: "CoInitialize"; File: "Zxl.dll") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "Zxl.dll") Found reference to API (Indicator: "CoCreateInstance"; File: "Zxl.dll") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "Zxl.dll") Found reference to API (Indicator: "CLSIDFromString"; File: "Zxl.dll") Found reference to API (Indicator: "CoUninitialize"; File: "Zxl.dll") Found reference to API (Indicator: "CoCreateGuid"; File: "Zxl.dll") Found reference to API (Indicator: "OleInitialize"; File: "Zxl.dll") Found reference to API (Indicator: "OleUninitialize"; File: "Zxl.dll") Found reference to API (Indicator: "StringFromCLSID"; File: "Zxl.dll") Found reference to API (Indicator: "CoTaskMemFree"; File: "Zxl.dll") Found reference to API (Indicator: "StringFromGUID2"; File: "Zxl.dll") Found reference to API (Indicator: "GetVersion"; File: "Zxl.dll") Found reference to API (Indicator: "CreateFile2"; File: "Zxl.dll") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "Zxl.dll") Found reference to API (Indicator: "UuidCreate"; File: "Zxl.dll") Found reference to API (Indicator: "UuidCreateSequential"; File: "Zxl.dll") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00007172.00000000.145734.00951000.00000020.mdmp")34:T1327,Found reference to API "WinExec" (Indicator: "WinExec"; File: "Zxl.dll") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "Zxl.dll") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002288.00000000.141620.03610000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003144.00000000.141945.00660000.00000004.mdmp, 00000000-00003144.00000001.143547.00660000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003416.00000000.142560.00730000.00000004.mdmp, 00000000-00003416.00000001.144161.00730000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003520.00000000.148341.03120000.00000004.mdmp, 00000000-00003520.00000001.149942.03120000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003636.00000000.151540.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003704.00000000.150268.02FA0000.00000004.mdmp, 00000000-00003704.00000001.151166.02FA0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004216.00000000.140634.03280000.00000004.mdmp, 00000000-00004216.00000001.142235.03280000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004716.00000001.145408.00730000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005560.00000000.141418.03100000.00000004.mdmp, 00000000-00005560.00000001.143019.03100000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005684.00000000.143344.004E0000.00000004.mdmp, 00000000-00005684.00000001.143481.004E0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005880.00000000.145804.03540000.00000004.mdmp, 00000000-00005880.00000001.147410.03540000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006076.00000000.147736.006D0000.00000004.mdmp, 00000000-00006076.00000001.149341.006D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006180.00000000.143873.00410000.00000004.mdmp, 00000000-00006180.00000001.145478.00410000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006380.00000000.138706.02D30000.00000004.mdmp, 00000000-00006380.00000001.140309.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006468.00000000.151492.02EE0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006544.00000000.144487.03250000.00000004.mdmp, 00000000-00006544.00000001.146088.03250000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006676.00000000.138706.02D60000.00000004.mdmp, 00000000-00006676.00000001.139165.02D60000.00000004.mdmp")35:T8c5,"Zxl.dll" contains export function called "??$HDREnhance@E@@YGHKKPAE0HP6GHHHPAX@Z1@Z" at ordinal 1 "Zxl.dll" contains export function called "??$HDREnhance@G@@YGHKKPAEPAGHP6GHHHPAX@Z2@Z" at ordinal 2 "Zxl.dll" contains export function called "??0BackgroundContextT@ZNRM@@QAE@XZ" at ordinal 3 "Zxl.dll" contains export function called "??0CBmpScrDevice@@QAE@AAV0@@Z" at ordinal 4 "Zxl.dll" contains export function called "??0CBmpScrDevice@@QAE@XZ" at ordinal 5 "Zxl.dll" contains export function called "??0CCartoon@@QAE@PAEHUZppSize@@HP6GHHHPAX@Z2@Z" at ordinal 6 "Zxl.dll" contains export function called "??0CCartoon@@QAE@XZ" at ordinal 7 "Zxl.dll" contains export function called "??0CColor@@QAE@ABV0@@Z" at ordinal 8 "Zxl.dll" contains export function called "??0CColor@@QAE@EK@Z" at ordinal 9 "Zxl.dll" contains export function called "??0CColor@@QAE@EKVCZString@@@Z" at ordinal 10 "Zxl.dll" contains export function called "??0CColor@@QAE@K@Z" at ordinal 11 "Zxl.dll" contains export function called "??0CColor@@QAE@PAUtagCOLORDATA@@@Z" at ordinal 12 "Zxl.dll" contains export function called "??0CColor@@QAE@PAUtagCOLORDATALITE@@@Z" at ordinal 13 "Zxl.dll" contains export function called "??0CColor@@QAE@VCZString@@E@Z" at ordinal 14 "Zxl.dll" contains export function called "??0CColor@@QAE@XZ" at ordinal 15 "Zxl.dll" contains export function called "??0CDirectDevice@@QAE@AAV0@@Z" at ordinal 16 "Zxl.dll" contains export function called "??0CDirectDevice@@QAE@PAUHDC__@@PAVCMapper@@@Z" at ordinal 17 "Zxl.dll" contains export function called "??0CEDOMW@@QAE@XZ" at ordinal 18 "Zxl.dll" contains export function called "??0CExportPDF@@QAE@PB_WHI0HPAUCompressionTypes@@00000@Z" at ordinal 19 "Zxl.dll" contains export function called "??0CIterator@@QAE@ABV0@@Z" at ordinal 20 "Zxl.dll" contains export function called "??0CIterator@@QAE@PAVCStdServer@@@Z" at ordinal 21 "Zxl.dll" contains export function called "??0CMapper@@QAE@XZ" at ordinal 22 "Zxl.dll" contains export function called "??0CObjBase@@QAE@AAV0@@Z" at ordinal 23 "Zxl.dll" contains export function called "??0CObjBase@@QAE@XZ" at ordinal 24 "Zxl.dll" contains export function called "??0COilify@@QAE@PAEHUZppSize@@HP6GHHHPAX@Z2@Z" at ordinal 2536:T1d0d,"Software\ZONER\Language" in Source: Zxl.dll "Software\ZONER\Autoupdater\product.%04d" in Source: Zxl.dll "SOFTWARE\GPL Ghostscript" in Source: Zxl.dll "SOFTWARE\AFPL Ghostscript" in Source: Zxl.dll "SOFTWARE\Aladdin Ghostscript" in Source: Zxl.dll "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: Zxl.dll "Software\ZONER\Zoner Photo Studio 18" in Source: 38878-9235-10273BF0 "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000404.00000000.145058.029D0000.00000004.mdmp 00000000-00000404.00000001.146659.029D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000404.00000000.145058.029D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000896.00000000.149668.034C0000.00000004.mdmp 00000000-00000896.00000001.151273.034C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001300.00000001.151208.03110000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001488.00000000.141202.03310000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001508.00000000.139491.005F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001508.00000000.139491.005F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001760.00000000.146984.005D0000.00000004.mdmp 00000000-00001760.00000001.147322.005D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001760.00000000.146984.005D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002288.00000000.141620.03610000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003144.00000000.141945.00660000.00000004.mdmp 00000000-00003144.00000001.143547.00660000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003144.00000000.141945.00660000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003416.00000000.142560.00730000.00000004.mdmp 00000000-00003416.00000001.144161.00730000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003416.00000000.142560.00730000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003520.00000000.148341.03120000.00000004.mdmp 00000000-00003520.00000001.149942.03120000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003520.00000000.148341.03120000.00000004.mdmp 00000000-00003520.00000001.149942.03120000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003636.00000000.151540.02CD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003704.00000000.150268.02FA0000.00000004.mdmp 00000000-00003704.00000001.151166.02FA0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003704.00000000.150268.02FA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004216.00000000.140634.03280000.00000004.mdmp 00000000-00004216.00000001.142235.03280000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004216.00000000.140634.03280000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004716.00000001.145408.00730000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005560.00000000.141418.03100000.00000004.mdmp 00000000-00005560.00000001.143019.03100000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005560.00000001.143019.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005684.00000000.143344.004E0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005684.00000000.143344.004E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005880.00000000.145804.03540000.00000004.mdmp 00000000-00005880.00000001.147410.03540000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005880.00000000.145804.03540000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006076.00000000.147736.006D0000.00000004.mdmp 00000000-00006076.00000001.149341.006D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006076.00000000.147736.006D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006180.00000000.143873.00410000.00000004.mdmp 00000000-00006180.00000001.145478.00410000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006180.00000000.143873.00410000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006380.00000000.138706.02D30000.00000004.mdmp 00000000-00006380.00000001.140309.02D30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006468.00000000.151492.02EE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006544.00000000.144487.03250000.00000004.mdmp 00000000-00006544.00000001.146088.03250000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006544.00000000.144487.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000000.138706.02D60000.00000004.mdmp 00000000-00006676.00000001.139165.02D60000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006676.00000000.138706.02D60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006740.00000000.147648.032C0000.00000004.mdmp 00000000-00006740.00000001.149246.032C0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006740.00000000.147648.032C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006952.00000000.151502.02C40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006976.00000000.146414.03250000.00000004.mdmp 00000000-00006976.00000001.148015.03250000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006976.00000000.146414.03250000.00000004.mdmp 00000000-00006976.00000001.148015.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007032.00000000.151600.02B00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007172.00000001.147336.03090000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007232.00000000.138706.005F0000.00000004.mdmp37:T90d,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7232:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7232:64:WilError_01" Process rundll32.exe created mutex with name "SM0:7232:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:7232:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6380:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6380:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:6380:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:6380:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6676:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6676:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:6676:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:6676:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7452:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7452:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:7452:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:7452:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7288:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7288:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:7288:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:7288:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1508:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1508:64:WilError_01" Process rundll32.exe created mutex with name "Local\SM0:1508:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:1508:64:WilError_01" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7572:168:WilStaging_02"38:T85b,Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#1" (UID: 00000000-00007232) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#2" (UID: 00000000-00006380) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#3" (UID: 00000000-00006676) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#4" (UID: 00000000-00007452) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#5" (UID: 00000000-00007288) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#6" (UID: 00000000-00001508) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#7" (UID: 00000000-00007572) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#8" (UID: 00000000-00004216) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#9" (UID: 00000000-00001488) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#10" (UID: 00000000-00005560) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#11" (UID: 00000000-00002288) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#12" (UID: 00000000-00003144) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#13" (UID: 00000000-00003416) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#14" (UID: 00000000-00008092) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#15" (UID: 00000000-00005684) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#16" (UID: 00000000-00004716) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#17" (UID: 00000000-00006180) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#18" (UID: 00000000-00006544) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#19" (UID: 00000000-00000404) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#20" (UID: 00000000-00007172) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#21" (UID: 00000000-00005880) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#22" (UID: 00000000-00006976) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#23" (UID: 00000000-00001760) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#24" (UID: 00000000-00006740) Process "rundll32.exe" with commandline ""C:\\Zxl.dll",#25" (UID: 00000000-00007724)39:T2623,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000404.00000000.145058.029D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000404.00000000.145058.029D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000404.00000001.146659.029D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000896.00000000.149668.034C0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000896.00000001.151273.034C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001300.00000001.151208.03110000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001488.00000000.141202.03310000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001508.00000000.139491.005F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001508.00000000.139491.005F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001760.00000000.146984.005D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001760.00000000.146984.005D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001760.00000001.147322.005D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002288.00000000.141620.03610000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003144.00000000.141945.00660000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003144.00000000.141945.00660000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003144.00000001.143547.00660000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003416.00000000.142560.00730000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003416.00000000.142560.00730000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003416.00000001.144161.00730000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003520.00000000.148341.03120000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003520.00000000.148341.03120000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003520.00000001.149942.03120000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003520.00000001.149942.03120000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003636.00000000.151540.02CD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003704.00000000.150268.02FA0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003704.00000000.150268.02FA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003704.00000001.151166.02FA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004216.00000000.140634.03280000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004216.00000000.140634.03280000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004216.00000001.142235.03280000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004716.00000001.145408.00730000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005560.00000000.141418.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005560.00000001.143019.03100000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005560.00000001.143019.03100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005684.00000000.143344.004E0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005684.00000000.143344.004E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005880.00000000.145804.03540000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005880.00000000.145804.03540000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005880.00000001.147410.03540000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006076.00000000.147736.006D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006076.00000000.147736.006D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006076.00000001.149341.006D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006180.00000000.143873.00410000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006180.00000000.143873.00410000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006180.00000001.145478.00410000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006380.00000000.138706.02D30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006380.00000001.140309.02D30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006468.00000000.151492.02EE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006544.00000000.144487.03250000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006544.00000000.144487.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006544.00000001.146088.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000000.138706.02D60000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006676.00000000.138706.02D60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000001.139165.02D60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006740.00000000.147648.032C0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006740.00000000.147648.032C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006740.00000001.149246.032C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006952.00000000.151502.02C40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006976.00000000.146414.03250000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006976.00000000.146414.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006976.00000001.148015.03250000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006976.00000001.148015.03250000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007032.00000000.151600.02B00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007172.00000001.147336.03090000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007232.00000000.138706.005F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000001.140877.02E20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007452.00000000.138713.02A50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007452.00000001.138949.02A50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007572.00000000.139693.03070000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007572.00000000.139693.03070000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007572.00000001.141294.03070000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007724.00000001.149268.00770000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007992.00000001.151173.02B60000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007992.00000001.151173.02B60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008092.00000000.143129.02E20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008092.00000001.144731.02E20000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00008092.00000001.144731.02E20000.00000004.mdmp3a:T465,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77390000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77390000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77390000 "rundll32.exe" loaded module "KERNEL32" at base 77b80000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fe0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74140000 "rundll32.exe" loaded module "COMCTL32.DLL" at base 73900000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 77b80000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75560000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74ca0000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 75460000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 74a40000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 777e0000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 777e0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 747c00003b:T924,Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#2" (UID: 00000000-00006380) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#3" (UID: 00000000-00006676) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#4" (UID: 00000000-00007452) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#5" (UID: 00000000-00007288) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#6" (UID: 00000000-00001508) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#7" (UID: 00000000-00007572) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#8" (UID: 00000000-00004216) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#9" (UID: 00000000-00001488) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#10" (UID: 00000000-00005560) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#11" (UID: 00000000-00002288) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#12" (UID: 00000000-00003144) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#13" (UID: 00000000-00003416) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#14" (UID: 00000000-00008092) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#15" (UID: 00000000-00005684) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#16" (UID: 00000000-00004716) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#17" (UID: 00000000-00006180) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#18" (UID: 00000000-00006544) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#19" (UID: 00000000-00000404) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#20" (UID: 00000000-00007172) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#21" (UID: 00000000-00005880) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#22" (UID: 00000000-00006976) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#23" (UID: 00000000-00001760) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#24" (UID: 00000000-00006740) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#25" (UID: 00000000-00007724) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#26" (UID: 00000000-00006076)3c:T924,Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#2" (UID: 00000000-00006380) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#3" (UID: 00000000-00006676) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#4" (UID: 00000000-00007452) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#5" (UID: 00000000-00007288) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#6" (UID: 00000000-00001508) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#7" (UID: 00000000-00007572) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#8" (UID: 00000000-00004216) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#9" (UID: 00000000-00001488) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#10" (UID: 00000000-00005560) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#11" (UID: 00000000-00002288) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#12" (UID: 00000000-00003144) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#13" (UID: 00000000-00003416) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#14" (UID: 00000000-00008092) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#15" (UID: 00000000-00005684) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#16" (UID: 00000000-00004716) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#17" (UID: 00000000-00006180) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#18" (UID: 00000000-00006544) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#19" (UID: 00000000-00000404) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#20" (UID: 00000000-00007172) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#21" (UID: 00000000-00005880) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#22" (UID: 00000000-00006976) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#23" (UID: 00000000-00001760) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#24" (UID: 00000000-00006740) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#25" (UID: 00000000-00007724) Spawned process "rundll32.exe" with commandline ""C:\\Zxl.dll",#26" (UID: 00000000-00006076)3d:T44b,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 5B:8F:88:C8:0A:73:D3:5F:76:CD:41:2A:9E:74:E9:16:59:4D:FA:67; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US" (SHA1: 99:69:B3:E5:52:79:8F:0A:7A:3A:30:C8:DB:60:49:93:AC:93:CF:03; see report for more information)3e:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")3f:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")40:T434,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: The input sample contains a known anti-VM trick Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API)41:T64d,"rundll32.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "rundll32.exe" trying to access non-existent file "C:\VERSION.DLL" "rundll32.exe" trying to access non-existent file "C:\VERSION.dll" "rundll32.exe" trying to access non-existent file "C:\MSCMS.DLL" "rundll32.exe" trying to access non-existent file "C:\mscms.dll" "rundll32.exe" trying to access non-existent file "C:\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\System\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\system\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\system32\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\zcl.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ZCL.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\zcl.dll"42:Tff6,Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Heuristic match: ".info" Pattern match: "http://zonerama.com/services/zps16" Heuristic match: "zonerama.com" Pattern match: "http://zonerama.com" Heuristic match: ".zonerama.com" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/tiff/1.0/" Pattern match: "http://ns.adobe.com/exif/1.0/" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/exif/1.0/aux/" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "http://ns.adobe.com/camera-raw-settings/1.0/" Pattern match: "http://ns.adobe.com/xmp/1.0/dynamicmedia/" Pattern match: "http://ns.adobe.com/xmp/1.0/script/" Pattern match: "http://ns.adobe.com/bwf/bext/1.0/" Pattern match: "http://ns.adobe.com/stockphoto/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/t/" Pattern match: "http://ns.adobe.com/xap/1.0/t/pg/" Pattern match: "http://ns.adobe.com/xap/1.0/g/" Pattern match: "http://ns.adobe.com/xap/1.0/g/img/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/font#" Pattern match: "http://ns.adobe.com/xap/1.0/rights/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://ns.adobe.com/album/1.0/" Pattern match: "http://cipa.jp/exif/1.0/" Pattern match: "http://ns.adobe.com/png/1.0/" Pattern match: "http://ns.adobe.com/jpeg/1.0/" Pattern match: "http://ns.adobe.com/jp2k/1.0/" Pattern match: "http://ns.adobe.com/asf/1.0/" Pattern match: "http://ns.adobe.com/xmp/wav/1.0/" Pattern match: "http://ns.adobe.com/creatoratom/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/bj/" Pattern match: "http://ns.adobe.com/xmp/note/" Pattern match: "http://ns.adobe.com/aes/cart/" Pattern match: "http://ns.adobe.com/riff/info/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/dimensions#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceevent#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceref#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/version#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/job#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/manifestitem#" Pattern match: "http://ns.adobe.com/xmp/identifier/qual/1.0/" Pattern match: "http://iptc.org/std/iptc4xmpcore/1.0/xmlns/" Pattern match: "http://iptc.org/std/iptc4xmpext/2008-02-29/" Pattern match: "http://ns.adobe.com/dicom/" Pattern match: "http://ns.useplus.org/ldf/xmp/1.0/" Pattern match: "http://www.aiim.org/pdfa/ns/schema#" Pattern match: "http://www.aiim.org/pdfa/ns/property#" Pattern match: "http://www.aiim.org/pdfa/ns/type#" Pattern match: "http://www.aiim.org/pdfa/ns/field#" Pattern match: "http://www.aiim.org/pdfa/ns/id/" Pattern match: "http://www.aiim.org/pdfa/ns/extension/" Pattern match: "http://ns.adobe.com/pdfx/1.3/" Pattern match: "http://www.npes.org/pdfx/ns/id/" Pattern match: "http://ns.adobe.com/ix/1.0/" Heuristic match: "catitemfts.name" Pattern match: "http://zoner.com/xmp/userdata/1.0/" Heuristic match: "zoner.name" Pattern match: "http://ns.iview-multimedia.com/mediapro/1.0/" Pattern match: "schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://purl.org/dc/1.1/" Heuristic match: "nxacatitemsfts.name" Heuristic match: "ma.com" Heuristic match: "tp://zonerama.com" Pattern match: "http://www.winimage.com/zlibdll" Pattern match: "http://www.iec.ch" Pattern match: "http://ns.adobe.com/camera-raw-saved-settings/1.0/" Pattern match: "http://ns.adobe.com/photoshop/1.0/camera-profile" Pattern match: "http://ns.adobe.com/lightroom-settings-experimental/1.0/" Pattern match: "http://ns.adobe.com/dng/1.0/" Heuristic match: "??\c:\zxl.de" Heuristic match: "s\x86_microsoft.windows.co" Heuristic match: "=yv.td" Heuristic match: "hu.nl"43:T411,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Zxl.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Zxl.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Zxl.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Zxl.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Zxl.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp")44:T77e,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Zxl.dll") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "Zxl.dll") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Zxl.dll") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; File: "Zxl.dll") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "Zxl.dll") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Zxl.dll") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Zxl.dll") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Zxl.dll") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "Zxl.dll") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Zxl.dll") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Zxl.dll") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Zxl.dll") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Zxl.dll") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Zxl.dll") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Zxl.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Zxl.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Zxl.dll") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005684.00000001.143481.00959000.00000002.mdmp")45:T11a9,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000404.00000000.145058.029D0000.00000004.mdmp, 00000000-00000404.00000001.146659.029D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000896.00000000.149668.034C0000.00000004.mdmp, 00000000-00000896.00000001.151273.034C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001300.00000001.151208.03110000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001488.00000000.141202.03310000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001508.00000000.139491.005F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001760.00000000.146984.005D0000.00000004.mdmp, 00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001760.00000001.147322.005D0000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002288.00000000.141620.03610000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002288.00000000.141620.03610000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003144.00000000.141945.00660000.00000004.mdmp, 00000000-00003144.00000001.143547.00660000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003144.00000000.141945.00660000.00000004.mdmp, 00000000-00003144.00000001.143547.00660000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003144.00000000.141945.00660000.00000004.mdmp, 00000000-00003144.00000001.143547.00660000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.142560.00730000.00000004.mdmp, 00000000-00003416.00000001.144161.00730000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003416.00000000.142560.00730000.00000004.mdmp, 00000000-00003416.00000001.144161.00730000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003416.00000000.142560.00730000.00000004.mdmp, 00000000-00003416.00000001.144161.00730000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003520.00000000.148341.03120000.00000004.mdmp, 00000000-00003520.00000001.149942.03120000.00000004.mdmp")46:T7ba,"rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "E320000000000000040004000100010001010000F1D9A3007800020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C0CC9900C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005B000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100C45F7F00CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000400400100000571AE006041AE00682C9000F1D9A300010043010000C0EC7C0000")47:T525,RegCreateKeyExA RegDeleteValueW RegOpenKeyExA RegEnumKeyExW RegDeleteKeyA RegCreateKeyExW OpenProcessToken RegEnumKeyExA RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteValueA RegDeleteKeyW GetTempPathA MapViewOfFile GetDriveTypeW OutputDebugStringA FindResourceA GetModuleHandleA WinExec GetModuleFileNameW GetModuleFileNameA LockResource GetSystemInfo GetModuleHandleW GetTempFileNameA LoadLibraryW FindFirstFileW CreateFileA GetFileSizeEx OpenFileMappingW LoadLibraryA GetLogicalDrives GetVersionExW TerminateProcess CreateFileMappingW CopyFileW GetTempFileNameW GetTickCount FindNextFileW DeleteFileA OpenProcess FindResourceW GetProcAddress FindFirstFileExW GetFileAttributesA WriteFile GetVersionExA Sleep DeviceIoControl CreateThread CreateProcessW CreateDirectoryW GetFileAttributesExW GetModuleHandleExW OutputDebugStringW GetTempPathW GetFileAttributesW IsDebuggerPresent CreateFileMappingA DeleteFileW CreateFileW GetFileSize FindFirstFileA FindNextFileA ShellExecuteW GetCursorPos SetWindowsHookExW FindWindowW GetUpdateRgn GetWindowThreadProcessId GetUpdateRect InternetConnectW InternetWriteFile HttpQueryInfoW HttpSendRequestW HttpSendRequestExW InternetCloseHandle InternetOpenW InternetReadFile InternetQueryDataAvailable48:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC49:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC50:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC51:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC52:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC53:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC54:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC55:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC56:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC57:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC58:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC59:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC5f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC60:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC61:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC62:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC63:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC64:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC65:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC66:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC67:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC68:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC69:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC6a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":77,"unified_at_epoch_ms":1791605338077,"unified_at":"2026-10-10T04:08:58.077Z","metadata":{"hashes":{"sha256":"628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879","sha1":"deba423235f67194e4e79d64179d48d9ae4c992b","md5":"f5421556e732e405a0ee770239414063","sha512":"6b0dfbe4fd7499004e1ebc655fce6e71c0ef3c8f66f1229ac462ace33349385b8ce421c0733f58e0bebe00486016da81d697c14bd4b9fcafbf833e83f2a14d74","ssdeep":"98304:zHZUK424G4roVRnzPqhGyV8gw240CAlUcu2rDOYFpTPaeW4t8P5EYF85b/yPSOH:cVknzPqhGy424fT2rDOY3Pjt45E/X4","ssdeep_chunks":["98304:zHZUK42","98304:HZUK424","98304:ZUK424G","98304:UK424G4","98304:K424G4r","98304:424G4ro","98304:24G4roV","98304:4G4roVR","98304:G4roVRn","98304:4roVRnz","98304:roVRnzP","98304:oVRnzPq","98304:VRnzPqh","98304:RnzPqhG","98304:nzPqhGy","98304:zPqhGyV","98304:PqhGyV8","98304:qhGyV8g","98304:hGyV8gw","98304:GyV8gw2","98304:yV8gw24","98304:V8gw240","98304:8gw240C","98304:gw240CA","98304:w240CAl","98304:240CAlU","98304:40CAlUc","98304:0CAlUcu","98304:CAlUcu2","98304:AlUcu2r","98304:lUcu2rD","98304:Ucu2rDO","98304:cu2rDOY","98304:u2rDOYF","98304:2rDOYFp","98304:rDOYFpT","98304:DOYFpTP","98304:OYFpTPa","98304:YFpTPae","98304:FpTPaeW","98304:pTPaeW4","98304:TPaeW4t","98304:PaeW4t8","98304:aeW4t8P","98304:eW4t8P5","98304:W4t8P5E","98304:4t8P5EY","98304:t8P5EYF","98304:8P5EYF8","98304:P5EYF85","98304:5EYF85b","98304:EYF85b/","98304:YF85b/y","98304:F85b/yP","98304:85b/yPS","98304:5b/yPSO","98304:b/yPSOH","196608:zHZUK42","196608:HZUK424","196608:ZUK424G","196608:UK424G4","196608:K424G4r","196608:424G4ro","196608:24G4roV","196608:4G4roVR","196608:G4roVRn","196608:4roVRnz","196608:roVRnzP","196608:oVRnzPq","196608:VRnzPqh","196608:RnzPqhG","196608:nzPqhGy","196608:zPqhGyV","196608:PqhGyV8","196608:qhGyV8g","196608:hGyV8gw","196608:GyV8gw2","196608:yV8gw24","196608:V8gw240","196608:8gw240C","196608:gw240CA","196608:w240CAl","196608:240CAlU","196608:40CAlUc","196608:0CAlUcu","196608:CAlUcu2","196608:AlUcu2r","196608:lUcu2rD","196608:Ucu2rDO","196608:cu2rDOY","196608:u2rDOYF","196608:2rDOYFp","196608:rDOYFpT","196608:DOYFpTP","196608:OYFpTPa","196608:YFpTPae","196608:FpTPaeW","196608:pTPaeW4","196608:TPaeW4t","196608:PaeW4t8","196608:aeW4t8P","196608:eW4t8P5","196608:W4t8P5E","196608:4t8P5EY","196608:t8P5EYF","196608:8P5EYF8","196608:P5EYF85","196608:5EYF85b","196608:EYF85b/","196608:YF85b/y","196608:F85b/yP","196608:85b/yPS","196608:5b/yPSO","196608:b/yPSOH","98304:cVknzPq","98304:VknzPqh","98304:knzPqhG","98304:zPqhGy4","98304:PqhGy42","98304:qhGy424","98304:hGy424f","98304:Gy424fT","98304:y424fT2","98304:424fT2r","98304:24fT2rD","98304:4fT2rDO","98304:fT2rDOY","98304:T2rDOY3","98304:2rDOY3P","98304:rDOY3Pj","98304:DOY3Pjt","98304:OY3Pjt4","98304:Y3Pjt45","98304:3Pjt45E","98304:Pjt45E/","98304:jt45E/X","98304:t45E/X4"],"imphash":"90ad2364f9a8390548bd0f3054022715"},"file_info":{"file_name":"Zxl.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":9591368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1749134950000,"last_seen":1776361038000,"last_multi_scan":1776361038000}},"detections":{"summary":{"verdict":"malicious","score":77,"tags":["malgent"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":182,"suspicious_count":19,"malicious_count":0,"total":201},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.KUY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Agent.Win64.20270","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Downloader.Agent.Win64","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"suspicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to read the host's architecture"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to retrieve geographical location"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Zxl.dll\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Zxl.dll\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Zxl.dll\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"Zxl.dll\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Zxl.dll\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Zxl.dll\")\n Found reference to API \"?ZblSetFileTimeAsInExifW@@YA_NV?$shared_ptr@$$CBVZblContext@@@std@@PB_W@Z\" (Indicator: \"SetFileTime\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Zxl.dll\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Zxl.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Zxl.dll\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Zxl.dll\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Zxl.dll\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38878-4013-105F8A70\n SetUnhandledExceptionFilter@KERNEL32.dll at 38878-4059-105F8580","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"Zxl.dll\")\n Found reference to API \"CryptDecodeObject\" (Indicator: \"CryptDecodeObject\"; File: \"Zxl.dll\")\n Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"Zxl.dll\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"Zxl.dll\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Zxl.dll\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Zxl.dll\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Zxl.dll\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Zxl.dll\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Zxl.dll\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Zxl.dll\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"Zxl.dll\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"Zxl.dll\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"Zxl.dll\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"Zxl.dll\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"Zxl.dll\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"Zxl.dll\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"Zxl.dll\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007232)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006380)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007232)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2c","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Zxl.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 38878-7228-103A91E0\n GetTickCount@KERNEL32.dll at 38878-8282-1030AA90\n GetTickCount@KERNEL32.dll at 38878-27337-106680D0\n GetTickCount@KERNEL32.dll at 38878-28547-105F3890\n GetTickCount@KERNEL32.dll at 38878-28612-105EDDF0\n GetTickCount@KERNEL32.dll at 38878-28613-105ED510\n GetTickCount@KERNEL32.dll at 38878-32025-103E6781\n GetTickCount@KERNEL32.dll at 38878-32163-103DF140\n GetTickCount@KERNEL32.dll at 38878-32396-103B1C50\n GetTickCount@KERNEL32.dll at 38878-32768-1030A740\n GetTickCount@KERNEL32.dll at 38878-39641-1021A103\n GetTickCount@KERNEL32.dll at 38878-43056-1040EA94\n GetTickCount@KERNEL32.dll at 38878-46365-105ED699","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 38878-7439-103971F0\n FindFirstFileW@KERNEL32.dll at 38878-7882-10352160\n FindFirstFileW@KERNEL32.dll at 38878-8189-10325E30\n FindFirstFileW@KERNEL32.dll at 38878-9135-1027CD10\n FindFirstFileW@KERNEL32.dll at 38878-9137-1027CAB0\n FindNextFileW@KERNEL32.dll at 38878-31723-10411261\n FindFirstFileW@KERNEL32.dll at 38878-31724-10410D20\n FindFirstFileW@KERNEL32.dll at 38878-32181-103DD340\n FindFirstFileW@KERNEL32.dll at 38878-32311-103C2650\n FindFirstFileW@KERNEL32.dll at 38878-32485-101FAA10\n FindFirstFileW@KERNEL32.dll at 38878-32486-101FAD40\n FindNextFileW@KERNEL32.dll at 38878-33641-101F5DD0\n FindFirstFileExW@KERNEL32.dll at 38878-33646-101F2EC0\n FindFirstFileW@KERNEL32.dll at 38878-43081-10410A05","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"Zxl.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.dll at 38878-5523-103CC7E0\n GetDriveTypeW@KERNEL32.dll at 38878-5526-103CC7C0\n GetDriveTypeW@KERNEL32.dll at 38878-6963-103B2B90\n GetDriveTypeW@KERNEL32.dll at 38878-31948-103B23E0\n GetLogicalDrives@KERNEL32.dll at 38878-32269-103C9390\n GetLogicalDrives@KERNEL32.dll at 38878-32270-103C9150\n GetLogicalDrives@KERNEL32.dll at 38878-33618-101F89F0\n GetLogicalDrives@KERNEL32.dll at 38878-33624-101F0060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0\" (Indicator: \"select * from \"; File: \"Zxl.dll\")\n Found string \"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';\" (Indicator: \"select * from \"; File: \"Zxl.dll\")\n Found string \"SELECT * FROM %Q.%Q\" (Indicator: \"select * from \"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.dll at 38878-3862-10647D60\n FileTimeToSystemTime@KERNEL32.dll at 38878-32315-10409B70\n FileTimeToSystemTime@KERNEL32.dll at 38878-32561-1039E040\n FileTimeToSystemTime@KERNEL32.dll at 38878-32571-1039D510\n FileTimeToSystemTime@KERNEL32.dll at 38878-32745-10339C90\n FileTimeToSystemTime@KERNEL32.dll at 38878-32863-102DC220\n FileTimeToSystemTime@KERNEL32.dll at 38878-32880-102D8710\n GetSystemTimeAsFileTime@KERNEL32.dll at 38878-33103-10273770\n FileTimeToSystemTime@KERNEL32.dll at 38878-33534-1020E910\n GetSystemTimeAsFileTime@KERNEL32.dll at 38878-33828-101E3920\n FileTimeToSystemTime@KERNEL32.dll at 38878-42777-103DCA92","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 38878-33103-10273770\n GetSystemTimeAsFileTime@KERNEL32.dll at 38878-33828-101E3920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 38878-3992-105F9730\n GetVersionExW@KERNEL32.dll at 38878-3993-105F95D0\n GetVersionExW@KERNEL32.dll at 38878-5523-103CC7E0\n GetVersionExW@KERNEL32.dll at 38878-29176-10574F50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 38878-4203-105CD220\n GetLocaleInfoW@KERNEL32.dll at 38878-4205-105CD1C0\n GetLocaleInfoW@KERNEL32.dll at 38878-4206-105CD160\n GetLocaleInfoW@KERNEL32.dll at 38878-4207-105CD100\n GetLocaleInfoW@KERNEL32.dll at 38878-4208-105CCF10\n GetLocaleInfoW@KERNEL32.dll at 38878-4210-105CCD30\n GetLocaleInfoA@KERNEL32.dll at 38878-32780-102F8A30\n GetLocaleInfoA@KERNEL32.dll at 38878-32865-102D6E90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 38878-4050-105F8980\n GetDiskFreeSpaceExW@KERNEL32.dll at 38878-33851-101E3530","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET NULL\" (Indicator: \"set \"; File: \"Zxl.dll\")\n Found string \"SET DEFAULT\" (Indicator: \"set \"; File: \"Zxl.dll\")\n Found string \"set list\" (Indicator: \"set \"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Zxl.dll\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Zxl.dll\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"Zxl.dll\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"IMG_COUNTRYCODE\" (Indicator: \"countrycode\") in Source: Zxl.dll\n \"CountryCode\" (Indicator: \"countrycode\") in Source: 38878-2979-104E0DD0\n \"Zoner.CountryCode\" (Indicator: \"countrycode\") in Source: 38878-9318-102692D0\n \"G_COUNTRYCODE\" (Indicator: \"countrycode\") in Source: Zxl.dll","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 38878-31076-104708B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Zxl.dll\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"Zxl.dll\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayout@USER32.dll at 38878-4206-105CD160\n GetKeyboardLayout@USER32.dll at 38878-4207-105CD100\n GetKeyboardLayoutList@USER32.dll at 38878-4212-105CCB70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"Zxl.dll\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"Zxl.dll\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"Zxl.dll\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"Zxl.dll\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"Zxl.dll\")\n Found reference to API \"?FavoritesGetVersionCookie@FoldersCore@Zoner@@YAHXZ\" (Indicator: \"GetVersion\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"Zxl.dll\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"Zxl.dll\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 38878-9133-1027D120\n OpenProcess@KERNEL32.dll at 38878-35298-10039D30\n OpenProcess@KERNEL32.dll at 38878-35561-10003840","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [esp+20h], 02h\" and \"je 103C8FDBh\" at 38878-5523-103CC7E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Zxl.dll\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Zxl.dll\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Zxl.dll\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Zxl.dll\")\n Found string \"?ZMoveFileWJournalAsRename@@YGHPB_W0HH@Z\" (Indicator: \"MoveFileW\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Zxl.dll\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Zxl.dll\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Projects\\Version 18\\Binary\\ReleaseWin32\\Zxl.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$30","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFileMappingFromApp\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"?ZmfCreateFileStream@@YAJPB_WPAPAUICalStream@@@Z\" (Indicator: \"CreateFile\"; File: \"Zxl.dll\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Zxl.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 38878-5284-103FDDE0\n LoadLibraryW@KERNEL32.dll at 38878-34167-10138010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"Zxl.dll\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"Zxl.dll\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"Zxl.dll\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"Zxl.dll\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Zxl.dll\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Zxl.dll\")\n Found reference to API \"?ZMoveFileWJournalAsRename@@YGHPB_W0HH@Z\" (Indicator: \"MoveFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Zxl.dll\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Zxl.dll\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: Zxl.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"rundll32.exe\" failed to load missing module \"C:\\Zxl.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Zxl.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"_@zmesortdata.zme\"\n Pattern match: \"_@zmealbum.ico\"\n Pattern match: \"_@zmecdburn.ico\"\n Pattern match: \"_@zmehtmlsite.ico\"\n Pattern match: \"_@zmealbumdata.zme\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 769F0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73550000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Zxl.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Zxl.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Zxl.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Zxl.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"210\" [Source: Zxl.dll]\n Observed large number of imported APIs from \"MSVCR110.dll\" : \"238\" [Source: Zxl.dll]\n Observed large number of imported APIs from \"ippi-7.0.dll\" : \"367\" [Source: Zxl.dll]\n Observed large number of imported APIs from \"zcl.dll\" : \"235\" [Source: Zxl.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Zxl.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Zxl.dll\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x10726cbe,call\t0x107291c1,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x10726cd3,add\tesp, 0xc,pop\tebp,ret\t0xc,push\t0x10,push\t0x10843ca8,call\t0x10726e20,xor\teax, eax,inc\teax,mov\tesi, eax,mov\tdword ptr [ebp - 0x1c], esi,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,mov\tedi, dword ptr [ebp + 0xc],mov\tdword ptr [0x108c6d00], edi,mov\tdword ptr [ebp - 4], eax,test\tedi, edi,jne\t0x10726d08,cmp\tdword ptr [0x1094c26c], edi,je\t0x10726ddc,cmp\tedi, eax,je\t0x10726d11,cmp\tedi, 2,jne\t0x10726d49,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x75e800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x123000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x75e76b\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x122e50\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00007232) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00007232) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3d","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Zxl.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Zxl.dll\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Zxl.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7232)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$40","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\ZXL.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Zxl.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\ZXL.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\ZXL.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RUNDLL32.EXE.LOCAL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\rundll32.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"Zxl.dll\")\n Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; File: \"Zxl.dll\")\n Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; File: \"Zxl.dll\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"Zxl.dll\")\n Found reference to API \"HttpSendRequestExW\" (Indicator: \"HttpSendRequest\"; File: \"Zxl.dll\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"Zxl.dll\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"Zxl.dll\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-type: multipart/form-data; charset=utf-8; boundary=\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"session\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"albumId\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"photoId\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"name\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"chunks\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"chunk\"\"; File: \"Zxl.dll\")\n Found string \"Content-Disposition: form-data; name=\"file\"; filename=\"\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"18.0.1.10\"\n \"3.8.11.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":1,"id":"yara-33","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"Zxl.dll\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"Zxl.dll\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"Zxl.dll\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"Zxl.dll\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"Zxl.dll\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Zxl.dll\")\n Found reference to API \"?ZBLBitBlt@@YAFPAUHDC__@@UtagRECT@@K1FHH@Z\" (Indicator: \"BitBlt\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"Zxl.dll\"\n Found registry query API: \"RegOpenKeyExA\" in file \"Zxl.dll\"\n Found registry query API: \"RegEnumKeyExW\" in file \"Zxl.dll\"\n Found registry query API: \"RegEnumValueA\" in file \"Zxl.dll\"\n Found registry query API: \"RegEnumKeyExA\" in file \"Zxl.dll\"\n Found registry query API: \"RegEnumKeyW\" in file \"Zxl.dll\"\n Found registry query API: \"RegOpenKeyExW\" in file \"Zxl.dll\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"Zxl.dll\"\n Found registry query API: \"RegEnumValueW\" in file \"Zxl.dll\"\n Found registry query API: \"RegQueryValueExA\" in file \"Zxl.dll\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Zxl.dll\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AEScart\" (Indicator: \"aes\"; File: \"Zxl.dll\")\n Found string \"http://ns.adobe.com/aes/cart/\" (Indicator: \"aes\"; File: \"Zxl.dll\")\n Found string \"3desc\" (Indicator: \"3des\"; File: \"Zxl.dll\")\n Found string \"aeskede\" (Indicator: \"aes\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Zxl.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"Zxl.dll\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Zxl.dll\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"Zxl.dll\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"Zxl.dll\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Zxl.dll\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Zxl.dll\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Zxl.dll\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Zxl.dll\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Zxl.dll\")\n Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Zxl.dll\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"Zxl.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"Zxl.dll\" contains export function called \"DllGetClassObject\" at ordinal 3112","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Zxl.dll\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Zxl.dll\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Zxl.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"Zxl.dll\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordhash\" (Indicator: \"password\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"Zxl.dll\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"Zxl.dll\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"Zxl.dll\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"Zxl.dll\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Zxl.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$45","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Zxl.dll\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Zxl.dll\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Zxl.dll\")\n Found reference to API \"?ZDeleteFileA@@YAHPBDH@Z\" (Indicator: \"DeleteFile\"; File: \"Zxl.dll\")\n Found reference to API \"?ZDeleteFileW@@YAHPB_WH@Z\" (Indicator: \"DeleteFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format %2d,\" (Indicator: \"format \"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"Zxl.dll\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"Zxl.dll\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"Zxl.dll\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"Zxl.dll\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"31,4584,113,,SystemParametersInfoW,user32.dll,\"00:36:04.578\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006676.00000000.138706.02D60000.00000004.mdmp, 00000000-00006676.00000001.139165.02D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 38878-35395-10029EA0","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Zxl.dll\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Zxl.dll\")\n Found reference to API \"__crtTerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Zxl.dll\")\n Found reference to API \"ZxlTerm_ZxlDoneTerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Zxl.dll\")\n Found reference to API \"m_ZxlDoneTerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Zxl.dll\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Zxl.dll\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"Zxl.dll\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"Zxl.dll\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"Zxl.dll\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005684.00000001.143481.00959000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Zxl.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"OutputDebugStringW@KERNEL32.dll at 38878-7463-103950C0\n OutputDebugStringA@KERNEL32.dll at 38878-7569-103812C0\n OutputDebugStringA@KERNEL32.dll at 38878-8868-102D5500\n OutputDebugStringA@KERNEL32.dll at 38878-8872-102D53E0\n IsDebuggerPresent@KERNEL32.dll at 38878-24502-1064D2E0\n OutputDebugStringW@KERNEL32.dll at 38878-24503-10408B80\n OutputDebugStringA@KERNEL32.dll at 38878-30735-104B5D9E\n OutputDebugStringA@KERNEL32.dll at 38878-32740-1033E290","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 38878-4009-105F8DE0\n GetModuleHandleW@KERNEL32.dll at 38878-4013-105F8A70\n GetModuleHandleW@KERNEL32.dll at 38878-28647-105EB5C0\n GetModuleHandleW@KERNEL32.dll at 38878-32198-103DB7E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\SysWOW64\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 3533878)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"WinExec@KERNEL32.dll at 38878-3853-10648540\n WinExec@KERNEL32.dll at 38878-3854-10648400\n ShellExecuteW@SHELL32.dll at 38878-9608-10253880","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.dll at 38878-30119-10520340","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"30109bc\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"30109bc\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1501083f\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"601052a\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"60107e1\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1501083f\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read the host's architecture","description":"GetEnvironmentVariableW@KERNEL32.dll at 38878-9131-1027D310\n GetEnvironmentVariableW@KERNEL32.dll at 38878-9134-1027CFE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-111","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@USER32.dll at 38878-10790-100F9F90\n GetKeyState@USER32.dll at 38878-27456-1065F020\n GetKeyState@USER32.dll at 38878-28349-10600BC1\n GetKeyState@USER32.dll at 38878-29046-10586E90\n GetAsyncKeyState@USER32.dll at 38878-30121-1051FCF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.dll at 38878-5239-1051FF20\n GetModuleFileNameW@KERNEL32.dll at 38878-5284-103FDDE0\n GetModuleFileNameW@KERNEL32.dll at 38878-7397-103A0B10\n GetModuleFileNameW@KERNEL32.dll at 38878-24577-1064D110\n GetModuleFileNameW@KERNEL32.dll at 38878-26536-10706610\n GetModuleFileNameW@KERNEL32.dll at 38878-32198-103DB7E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 38878-43081-10410A05","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.dll at 38878-9133-1027D120","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"CallNextHookEx@USER32.dll at 38878-28551-105F24A0\n CallNextHookEx@USER32.dll at 38878-46385-105F2471","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 38878-9262-102737F0\n TerminateProcess@KERNEL32.dll at 38878-35561-10003840","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$47","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"Zxl.dll\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE files contains large number of export functions (more than 100)","description":"Zxl.dll contains more than 100 export function","origin":"Static Parser","relevance":5,"id":"static-98","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]}]},"activity":{"stats":{"process_count":36,"spawned_processes_count":36,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":140,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malgent"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"69e11e4d8a4dea310504ffc0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"Agent.KUY.gen","submit_name":"Zxl.dll","analysis_start_time":"2026-04-16T17:37:19+00:00","indicators_count":{"informative":182,"suspicious":22,"malicious":0},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}],"processes":[{"pid":5548,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00005548"},{"pid":7232,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007232","icon":"$48"},{"pid":6380,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006380","icon":"$49"},{"pid":6676,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006676","icon":"$4a"},{"pid":7452,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007452","icon":"$4b"},{"pid":7288,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007288","icon":"$4c"},{"pid":1508,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001508","icon":"$4d"},{"pid":7572,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007572","icon":"$4e"},{"pid":4216,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004216","icon":"$4f"},{"pid":1488,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#9","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001488","icon":"$50"},{"pid":5560,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#10","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005560","icon":"$51"},{"pid":2288,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#11","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002288","icon":"$52"},{"pid":3144,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#12","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003144","icon":"$53"},{"pid":3416,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#13","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003416","icon":"$54"},{"pid":8092,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#14","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008092","icon":"$55"},{"pid":5684,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#15","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005684","icon":"$56"},{"pid":4716,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#16","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004716","icon":"$57"},{"pid":6180,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#17","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006180","icon":"$58"},{"pid":6544,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#18","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006544","icon":"$59"},{"pid":404,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#19","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000404","icon":"$5a"},{"pid":7172,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#20","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007172","icon":"$5b"},{"pid":5880,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#21","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005880","icon":"$5c"},{"pid":6976,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#22","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006976","icon":"$5d"},{"pid":1760,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#23","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001760","icon":"$5e"},{"pid":6740,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#24","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006740","icon":"$5f"},{"pid":7724,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#25","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007724","icon":"$60"},{"pid":6076,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#26","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006076","icon":"$61"},{"pid":3520,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#27","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003520","icon":"$62"},{"pid":7992,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#28","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007992","icon":"$63"},{"pid":1300,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#29","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001300","icon":"$64"},{"pid":896,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#30","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000896","icon":"$65"},{"pid":3704,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#31","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003704","icon":"$66"},{"pid":6468,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#32","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006468","icon":"$67"},{"pid":6952,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#33","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006952","icon":"$68"},{"pid":3636,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#34","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003636","icon":"$69"},{"pid":7032,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\Zxl.dll\",#35","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007032","icon":"$6a"}],"all_imported_dlls":["imm32.dll","KernelBase.dll","msvcp_win.dll","setupapi.dll","sspicli.dll","advapi32.dll","imagehlp.dll","ws2_32.dll","fltLib.dll","ntdll.dll","windows.storage.dll","kernel.appcore.dll","cryptsp.dll","msctf.dll","dwmapi.dll","comctl32.dll","win32u.dll","rpcrt4.dll","ntmarta.dll","WinTypes.dll","powrprof.dll","CoreUIComponents.dll","clbcatq.dll","wow64win.dll","user32.dll","cfgmgr32.dll","msasn1.dll","wow64.dll","AcLayers.dll","gdi32.dll","profapi.dll","comdlg32.dll","TextInputFramework.dll","version.dll","uxtheme.dll","kernel32.dll","cryptbase.dll","sechost.dll","shlwapi.dll","mpr.dll","bcrypt.dll","apphelp.dll","bcryptprimitives.dll","sfc_os.dll","msvcrt.dll","ucrtbase.dll","Zxl.dll","crypt32.dll","wow64cpu.dll","gdi32full.dll","sfc.dll","VxSSL32.dll","shell32.dll","oleaut32.dll","IPHLPAPI.DLL","CoreMessaging.dll","combase.dll","ole32.dll","mscms.dll","SHCore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7232:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7232:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6380:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6380:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6676:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6676:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7452:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7452:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7288:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1508:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:1508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:1508:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7572:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7572:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4216:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:4216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:4216:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1488:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:1488:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:1488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:5560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2288:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:2288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:2288:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3144:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:3144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:3144:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3416:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:3416:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:3416:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8092:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8092:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:8092:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:8092:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5684:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5684:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:5684:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:5684:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:4716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:4716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6180:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6180:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6544:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6544:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7172:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7172:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7172:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:5880:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6976:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6976:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:1760:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:1760:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6740:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6740:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7724:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7724:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7724:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7724:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3520:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3520:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:3520:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:3520:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7992:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7992:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1300:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:1300:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:1300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3704:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:3704:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:3704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6468:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6468:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:6952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:6952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:3636:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:3636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"Local\\SM0:7032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]},{"name":"SM0:7032:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e11e4d8a4dea310504ffc0"}]}]}},"report_ids":{"sandbox_job_ids":["69e11e4d8a4dea310504ffc0"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Downloader.Agent.Win64 Sample 628b3d1725dd… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 628b3d1725dd…. Malware family: Downloader.Agent.Win64. Threat score 77/100. 2/27 AV engines flagged this file. 0 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879"}],["$","meta","4",{"property":"og:title","content":"Malicious Downloader.Agent.Win64 Sample 628b3d1725dd… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 628b3d1725dd…. Malware family: Downloader.Agent.Win64. Threat score 77/100. 2/27 AV engines flagged this file. 0 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/628b3d1725dd4d33e8e2a4052a3f91603088198c8629d6aa386a868977c49879"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Downloader.Agent.Win64 Sample 628b3d1725dd… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 628b3d1725dd…. Malware family: Downloader.Agent.Win64. Threat score 77/100. 2/27 AV engines flagged this file. 0 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]]