33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 9c:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T932,"rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00001448) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00001448) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00001448) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00002700) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00002700) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00002700) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00003892) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00003892) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00003892) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00003432) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00003432) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00003432) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00003764) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00003764) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00003764) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00001064) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527960'}" (UID: 00000000-00001064) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527976'}" (UID: 00000000-00001064) "rundll32.exe" called "LoadResource with parameter {'hModule': '9502720', 'hResInfo': '9527992'}" (UID: 00000000-00000884)36:T5ad,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "HTCTL32.DLL") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "HTCTL32.DLL") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "HTCTL32.DLL") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "HTCTL32.DLL") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp")37:T428,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "HTCTL32.DLL") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "HTCTL32.DLL") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "HTCTL32.DLL") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp")38:T4c7,Process "WerFault.exe" [UID: 00000000-00000828] Process "WerFault.exe" [UID: 00000000-00001248] Process "WerFault.exe" [UID: 00000000-00002672] Process "WerFault.exe" [UID: 00000000-00000872] Process "WerFault.exe" [UID: 00000000-00000652] Process "WerFault.exe" [UID: 00000000-00001348] Process "WerFault.exe" [UID: 00000000-00000416] Process "WerFault.exe" [UID: 00000000-00003568] Process "WerFault.exe" [UID: 00000000-00000860] Process "WerFault.exe" [UID: 00000000-00003236] Process "WerFault.exe" [UID: 00000000-00001400] Process "WerFault.exe" [UID: 00000000-00003076] Process "WerFault.exe" [UID: 00000000-00001352] Process "WerFault.exe" [UID: 00000000-00000336] Process "WerFault.exe" [UID: 00000000-00001536] Process "WerFault.exe" [UID: 00000000-00001388] Process "WerFault.exe" [UID: 00000000-00003156] Process "WerFault.exe" [UID: 00000000-00002752] Process "WerFault.exe" [UID: 00000000-00003024] Process "WerFault.exe" [UID: 00000000-00002800] Process "WerFault.exe" [UID: 00000000-00003724] Process "WerFault.exe" [UID: 00000000-00003448] Process "WerFault.exe" [UID: 00000000-00002896] Process "WerFault.exe" [UID: 00000000-00002928] Process "WerFault.exe" [UID: 00000000-00000928]39:Tcb4,Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-81-101D637F Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-81-101D637F Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-164-101E5369 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-164-101E5369 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-497-101C58B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-497-101C58B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-498-101C55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-498-101C55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-499-101C5170 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-499-101C5170 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-502-101C4CF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-502-101C4CF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-503-101C48E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-503-101C48E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-892-101D0950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-892-101D0950 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-894-101D0500 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-896-101D0360 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-901-101D01C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-912-101CFEA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-924-101CFDD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-930-101CF540 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-934-101CFAC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-941-101CF640 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1073-101CC8E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1073-101CC8E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1093-101CAC30 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1185-101C8140 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1185-101C8140 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1186-101C7F80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1186-101C7F80 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1190-101C7810 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1190-101C7810 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1191-101C6BA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1191-101C6BA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1192-101B94E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1192-101B94E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1193-101B97C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1193-101B97C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 50271-1194-101C6940 Assembly shows XOR instruction xor ecx ebp in Stream UID: 50271-1194-101C69403a:T82a,Found XOR loop in file "sample.bin" at offset 130749; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 316041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 99479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 142633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 143252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 308421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 308879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 305566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 307746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 313324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 313874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 317020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320501; code bytes = 80303b:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001448) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002700) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000026000f00b00300000000288102010cf0080008881900acf3080095e12a77f07d2400feffffff833e2f7711000000f0273900000039008829390006000000d8f008000400000000000000220000007cf108001100000000003900f02739007cf10800145c2e77435c2e77dc800277020000000c023900000039005001390004000000880130775001390020f30800780139000000000022000000000000015001390033000000a02a390033003200330000006c006c00110000000000297700002977000000008af10800000000000a00000a983f39001401001595e12a77 (UID: 00000000-00002700) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003000) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003664) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000002a000b00240600000000df6917012cf01c0088873100ccf31c0095e12a7727952500feffffff833e2f7711000000f0275200000052008829520006000000f8f01c000400000000000000220000009cf11c001100000000005200f02752009cf11c00145c2e77435c2e77eb681777020000000c025200000052005001520004000000880130775001520040f31c00780152000000000022000000000000015001520033000000a02a520033003200330000006c006c0011000000000029770000297700000000aaf11c00000000000a00000a983f52001401001595e12a77 (UID: 00000000-00003764) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003764) "WerFault.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001064) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000884) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000304) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002484) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002236) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003648) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000564) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003836) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000676) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000015000f00f00100000000cc3e0e01f8f5060010882e0098f9060095e12a77e8c42600feffffff833e2f7711000000f8275e0000005e0090295e0006000000c4f6060004000000000000002200000068f706001100000000005e00f8275e0068f70600145c2e77435c2e77d03f0e77020000000c025e0000005e0050015e00040000008801307750015e000cf9060078015e0000000000220000000000000150015e0033000000a82a5e0033003200330000006c006c001100000000002977000029770000000076f706000000000009000009a03f5e001401001595e12a7750c02600 (UID: 00000000-00000676) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000964) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002776) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000039000f00f40b000000009f310f0120ef070010881200c0f2070095e12a7753d22600feffffff833e2f7711000000f8272600000026009029260006000000ecef070004000000000000002200000090f007001100000000002600f827260090f00700145c2e77435c2e77932e0f77020000000c022600000026005001260004000000880130775001260034f20700a40130770000000022000000000000015001260056004100c041260033003200330000006c006c00110000000000297700002977000000009ef007000000000033000033c40026005801005995e12a77ebd62600 (UID: 00000000-00002776) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003736) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001604) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002536)3c:Ta46,"rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002700) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003764) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000676) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002776) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002536) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001260) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003928)3d:T483,"rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003380) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003352) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00001448) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00002700) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003892) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003432) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003000) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003764) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00001064) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00002952) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00000884) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00000304) "rundll32.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003412)3e:T4ead,"rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003380) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003380) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003352) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003352) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001448) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter C:\HTCTL32.DLL (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002700) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003892) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003892) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003432) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003432) "rundll32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003432) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003664) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003664) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003664) "rundll32.exe" called "LoadLibrary" with a parameter C:\HTCTL32.DLL (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003764) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003764) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003568) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003568) "WerFault.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003568) "WerFault.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001064) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002952) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000884) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000304) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003412) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003412) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002484) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002236) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003916) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003916) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003648) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002140) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002140) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000764) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000764) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003836) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002180) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002180) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000964) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003736) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003736) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003736) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003736) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001604) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002536) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001260) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001260) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter WinInet.dll (UID: 00000000-00003796) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001912) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001912) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002420) "rundll32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002740)3f:Ta3eb,Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "HTCTL32.DLL") Found reference to API (Indicator: "RevertToSelf"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetTokenInformation"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetUserNameA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "LogonUserA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "OpenProcessToken"; File: "HTCTL32.DLL") Found reference to API (Indicator: "EncodePointer"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetFileSize"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TlsSetValue"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ExitProcess"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TerminateProcess"; File: "HTCTL32.DLL") Found reference to API (Indicator: "OpenProcess"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetEvent"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TlsAlloc"; File: "HTCTL32.DLL") Found reference to API (Indicator: "DecodePointer"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCommandLineA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetStringTypeW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetTempPathA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WriteConsoleW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CreateThread"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetLocaleInfoW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InterlockedExchange"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetACP"; File: "HTCTL32.DLL") Found reference to API (Indicator: "IsValidLocale"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCurrentThread"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TerminateThread"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetOEMCP"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapReAlloc"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CopyFileA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetProcessHeap"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WideCharToMultiByte"; File: "HTCTL32.DLL") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetStdHandle"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetModuleHandleW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "LoadLibraryW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetModuleFileNameA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "DeleteCriticalSection"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TlsFree"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InterlockedDecrement"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetVersion"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CreateMutexA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetTickCount"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetModuleFileNameW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapFree"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FlushFileBuffers"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetLocalTime"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetVersionExA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetLastError"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCurrentProcess"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapDestroy"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetModuleHandleA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetStdHandle"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCPInfo"; File: "HTCTL32.DLL") Found reference to API (Indicator: "LeaveCriticalSection"; File: "HTCTL32.DLL") Found reference to API (Indicator: "PulseEvent"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FatalAppExitA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetLocaleInfoA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetFilePointer"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CreateEventA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CloseHandle"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCurrentProcessId"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapSize"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetLastError"; File: "HTCTL32.DLL") Found reference to API (Indicator: "LoadLibraryA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetThreadPriority"; File: "HTCTL32.DLL") Found reference to API (Indicator: "EnterCriticalSection"; File: "HTCTL32.DLL") Found reference to API (Indicator: "IsValidCodePage"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetSystemTime"; File: "HTCTL32.DLL") Found reference to API (Indicator: "IsDebuggerPresent"; File: "HTCTL32.DLL") Found reference to API (Indicator: "OutputDebugStringA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WriteFile"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapAlloc"; File: "HTCTL32.DLL") Found reference to API (Indicator: "RtlUnwind"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetConsoleMode"; File: "HTCTL32.DLL") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TlsGetValue"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GlobalFree"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetCurrentThreadId"; File: "HTCTL32.DLL") Found reference to API (Indicator: "RaiseException"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CreateFileA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "Sleep"; File: "HTCTL32.DLL") Found reference to API (Indicator: "LCMapStringW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InitializeCriticalSection"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WaitForSingleObject"; File: "HTCTL32.DLL") Found reference to API (Indicator: "MultiByteToWideChar"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ReadFile"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FreeLibrary"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CreateFileW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetFileType"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HeapCreate"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetDateFormatA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InterlockedIncrement"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ReleaseMutex"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetProcAddress"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "HTCTL32.DLL") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetStartupInfoW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetEndOfFile"; File: "HTCTL32.DLL") Found reference to API (Indicator: "lstrlenA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "CompareStringA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetConsoleCP"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetHandleCount"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetMessageA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetDesktopWindow"; File: "HTCTL32.DLL") Found reference to API (Indicator: "PeekMessageA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "SetTimer"; File: "HTCTL32.DLL") Found reference to API (Indicator: "PostThreadMessageA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "wvsprintfA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "MessageBoxA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "PostMessageA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "DispatchMessageA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "KillTimer"; File: "HTCTL32.DLL") Found reference to API (Indicator: "TranslateMessage"; File: "HTCTL32.DLL") Found reference to API (Indicator: "wsprintfA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "PostQuitMessage"; File: "HTCTL32.DLL") Found reference to API (Indicator: "__WSAFDIsSet"; File: "HTCTL32.DLL") Found reference to API (Indicator: "htons"; File: "HTCTL32.DLL") Found reference to API (Indicator: "closesocket"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ioctlsocket"; File: "HTCTL32.DLL") Found reference to API (Indicator: "getsockname"; File: "HTCTL32.DLL") Found reference to API (Indicator: "getpeername"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WSAStartup"; File: "HTCTL32.DLL") Found reference to API (Indicator: "inet_addr"; File: "HTCTL32.DLL") Found reference to API (Indicator: "gethostbyname"; File: "HTCTL32.DLL") Found reference to API (Indicator: "inet_ntoa"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WSAGetLastError"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WSACleanup"; File: "HTCTL32.DLL") Found reference to API (Indicator: "gethostname"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WSASetLastError"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ntohs"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetOpenA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetQueryOptionA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetReadFile"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetCloseHandle"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetConnectA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetErrorDlg"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetSetOptionA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetSetStatusCallback"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetWriteFile"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HttpOpenRequestA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HttpQueryInfoA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HttpSendRequestA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "HttpSendRequestExA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "EnumProcessModules"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetAdaptersInfo"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WSAIoctl"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "HTCTL32.DLL") Found reference to API (Indicator: "ntohl"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WinHttpOpen"; File: "HTCTL32.DLL") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FlsFree"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FlsSetValue"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FlsGetValue"; File: "HTCTL32.DLL") Found reference to API (Indicator: "FlsAlloc"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetProcessWindowStation"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetLastActivePopup"; File: "HTCTL32.DLL") Found reference to API (Indicator: "GetActiveWindow"; File: "HTCTL32.DLL") Found reference to API (Indicator: "MessageBoxW"; File: "HTCTL32.DLL") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetSetStatusCallback"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ntohl"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "PulseEvent"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "wvsprintfA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "LogonUserA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "FatalAppExitA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp")40:T7b1,"HTCTL32.DLL" contains export function called "ctl_adddomain" at ordinal 1 "HTCTL32.DLL" contains export function called "ctl_addoperator" at ordinal 2 "HTCTL32.DLL" contains export function called "ctl_bridgename" at ordinal 3 "HTCTL32.DLL" contains export function called "ctl_broadcast" at ordinal 4 "HTCTL32.DLL" contains export function called "ctl_broadcastdata" at ordinal 5 "HTCTL32.DLL" contains export function called "ctl_call" at ordinal 6 "HTCTL32.DLL" contains export function called "ctl_callremote" at ordinal 7 "HTCTL32.DLL" contains export function called "ctl_clearpin" at ordinal 8 "HTCTL32.DLL" contains export function called "ctl_clientpinrequest" at ordinal 9 "HTCTL32.DLL" contains export function called "ctl_clientstatus" at ordinal 10 "HTCTL32.DLL" contains export function called "ctl_close" at ordinal 11 "HTCTL32.DLL" contains export function called "ctl_closeremote" at ordinal 12 "HTCTL32.DLL" contains export function called "ctl_connected" at ordinal 13 "HTCTL32.DLL" contains export function called "ctl_controlpinrequest" at ordinal 14 "HTCTL32.DLL" contains export function called "ctl_controlsendpin" at ordinal 15 "HTCTL32.DLL" contains export function called "ctl_escape" at ordinal 16 "HTCTL32.DLL" contains export function called "ctl_findslaves" at ordinal 17 "HTCTL32.DLL" contains export function called "ctl_findslaves2" at ordinal 18 "HTCTL32.DLL" contains export function called "ctl_findslavesex" at ordinal 19 "HTCTL32.DLL" contains export function called "ctl_getconnectivityinfo" at ordinal 20 "HTCTL32.DLL" contains export function called "ctl_getfailedreason" at ordinal 21 "HTCTL32.DLL" contains export function called "ctl_getfileinfo" at ordinal 22 "HTCTL32.DLL" contains export function called "ctl_getlocalipaddressinuse" at ordinal 23 "HTCTL32.DLL" contains export function called "ctl_getsession" at ordinal 24 "HTCTL32.DLL" contains export function called "ctl_hangup" at ordinal 2541:T8bf,Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#1" (UID: 00000000-00003380) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#2" (UID: 00000000-00003352) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#3" (UID: 00000000-00001448) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#4" (UID: 00000000-00002700) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#5" (UID: 00000000-00003892) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#6" (UID: 00000000-00003432) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#7" (UID: 00000000-00003000) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#8" (UID: 00000000-00003664) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#9" (UID: 00000000-00003764) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#10" (UID: 00000000-00001064) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#11" (UID: 00000000-00002952) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#12" (UID: 00000000-00000884) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#13" (UID: 00000000-00000304) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#14" (UID: 00000000-00003412) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#15" (UID: 00000000-00002484) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#16" (UID: 00000000-00002532) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#17" (UID: 00000000-00002236) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#18" (UID: 00000000-00003916) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#19" (UID: 00000000-00003648) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#20" (UID: 00000000-00002140) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#21" (UID: 00000000-00000764) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#22" (UID: 00000000-00000564) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#23" (UID: 00000000-00004048) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#24" (UID: 00000000-00003336) Process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#25" (UID: 00000000-00003836)42:T46d,"rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e10000 "rundll32.exe" loaded module "DWMAPI.DLL" at base 73c60000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "rundll32.exe" loaded module "KERNEL32" at base 76260000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c150000 "rundll32.exe" loaded module "C:\HTCTL32.DLL" at base 6b2f0000 "rundll32.exe" loaded module "PSAPI.DLL" at base 75650000 "WerFault.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "WerFault.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WerFault.exe" loaded module "KERNEL32" at base 76260000 "WerFault.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WerFault.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c150000 "rundll32.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 754c0000 "rundll32.exe" loaded module "WININET.DLL" at base 75ca000043:T988,Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#2" (UID: 00000000-00003352) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#3" (UID: 00000000-00001448) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#4" (UID: 00000000-00002700) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#5" (UID: 00000000-00003892) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#6" (UID: 00000000-00003432) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#7" (UID: 00000000-00003000) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#8" (UID: 00000000-00003664) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#9" (UID: 00000000-00003764) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#10" (UID: 00000000-00001064) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#11" (UID: 00000000-00002952) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#12" (UID: 00000000-00000884) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#13" (UID: 00000000-00000304) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#14" (UID: 00000000-00003412) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#15" (UID: 00000000-00002484) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#16" (UID: 00000000-00002532) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#17" (UID: 00000000-00002236) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#18" (UID: 00000000-00003916) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#19" (UID: 00000000-00003648) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#20" (UID: 00000000-00002140) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#21" (UID: 00000000-00000764) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#22" (UID: 00000000-00000564) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#23" (UID: 00000000-00004048) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#24" (UID: 00000000-00003336) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#25" (UID: 00000000-00003836) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#26" (UID: 00000000-00002180)44:T988,Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#2" (UID: 00000000-00003352) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#3" (UID: 00000000-00001448) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#4" (UID: 00000000-00002700) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#5" (UID: 00000000-00003892) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#6" (UID: 00000000-00003432) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#7" (UID: 00000000-00003000) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#8" (UID: 00000000-00003664) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#9" (UID: 00000000-00003764) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#10" (UID: 00000000-00001064) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#11" (UID: 00000000-00002952) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#12" (UID: 00000000-00000884) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#13" (UID: 00000000-00000304) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#14" (UID: 00000000-00003412) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#15" (UID: 00000000-00002484) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#16" (UID: 00000000-00002532) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#17" (UID: 00000000-00002236) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#18" (UID: 00000000-00003916) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#19" (UID: 00000000-00003648) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#20" (UID: 00000000-00002140) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#21" (UID: 00000000-00000764) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#22" (UID: 00000000-00000564) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#23" (UID: 00000000-00004048) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#24" (UID: 00000000-00003336) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#25" (UID: 00000000-00003836) Spawned process "rundll32.exe" with commandline ""C:\\HTCTL32.DLL",#26" (UID: 00000000-00002180)45:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 6B:5F:2A:56:49:F7:DB:21:AB:C5:5D:02:B9:D5:94:95:AB:DD:55:03; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)46:T6ff,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "")47:T925,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RUNDLL32"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "")48:T81d,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "HTCTL32.DLL") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "HTCTL32.DLL") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "HTCTL32.DLL") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "HTCTL32.DLL") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "HTCTL32.DLL") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "HTCTL32.DLL") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "HTCTL32.DLL") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; File: "HTCTL32.DLL") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "HTCTL32.DLL") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp")49:T416,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "HTCTL32.DLL") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "HTCTL32.DLL") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "HTCTL32.DLL") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "HTCTL32.DLL") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp")4a:Tc39,Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "HTCTL32.DLL") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "HTCTL32.DLL") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "HTCTL32.DLL") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "HTCTL32.DLL") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "HTCTL32.DLL") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "HTCTL32.DLL") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "HTCTL32.DLL") Found reference to API "gethostname" (Indicator: "gethostname"; File: "HTCTL32.DLL") Found reference to API "Sessionz %dz #%u Recv %-4u bytes %s" (Indicator: " recv "; File: "HTCTL32.DLL") Found reference to API "Error send returned 0 on connection %d" (Indicator: " send "; File: "HTCTL32.DLL") Found reference to API "Sessionz %dz #% Recv %-4u bytes %s" (Indicator: " recv "; File: "HTCTL32.DLL") Found reference to API "Cannot connect to gateway %s via web proxy, error %d" (Indicator: " connect "; File: "HTCTL32.DLL") Found reference to API "Cannot connect to gateway %s, error %d" (Indicator: " connect "; File: "HTCTL32.DLL") Found reference to API "Sessionz %dz #%u Send %-4u bytes %s" (Indicator: " send "; File: "HTCTL32.DLL") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000564.00000000.260853.00AF0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000676.00000000.261986.00A30000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001348.00000000.268697.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001912.00000000.266179.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002140.00000000.259750.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002236.00000000.264980.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002340.00000000.265047.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002420.00000000.267979.00920000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002484.00000000.258921.00920000.00000002.mdmp") Found reference to API "Sessionz %dz #%u Recv %-4u bytes %s" (Indicator: " recv "; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "Error send returned 0 on connection %d" (Indicator: " send "; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp")4b:T7fe,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "HTCTL32.DLL") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "HTCTL32.DLL") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "HTCTL32.DLL") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "HTCTL32.DLL") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "HTCTL32.DLL") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "HTCTL32.DLL") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp")4c:T6a2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "HTCTL32.DLL") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "HTCTL32.DLL") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "HTCTL32.DLL") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "HTCTL32.DLL") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "HTCTL32.DLL") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002484.00000000.258921.6B330000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003380.00000000.256304.00911000.00000020.mdmp")4d:T4cf,"FindFirstFileA@KERNEL32.DLL" in "rundll32.exe" "FindNextFileA@KERNEL32.DLL" in "rundll32.exe" "GetLogicalDriveStringsA@KERNEL32.DLL" in "rundll32.exe" "LoadLibraryW@KERNEL32.DLL" in "rundll32.exe" "CreateDirectoryW@KERNEL32.DLL" in "rundll32.exe" "FindNextFileW@KERNEL32.DLL" in "rundll32.exe" "FindResourceW@KERNEL32.DLL" in "rundll32.exe" "GetLogicalDriveStringsW@KERNEL32.DLL" in "rundll32.exe" "CreateToolhelp32Snapshot@KERNEL32.DLL" in "rundll32.exe" "LoadLibraryExA@KERNEL32.DLL" in "rundll32.exe" "Process32FirstW@KERNEL32.DLL" in "rundll32.exe" "GetNativeSystemInfo@KERNEL32.DLL" in "rundll32.exe" "FindFirstFileW@KERNEL32.DLL" in "rundll32.exe" "LoadResource@KERNEL32.DLL" in "rundll32.exe" "EncryptMessage@SSPICLI.DLL" in "rundll32.exe" "CopyFileA@KERNEL32.DLL" in "rundll32.exe" "CopyFileW@KERNEL32.DLL" in "rundll32.exe" "FindResourceA@KERNEL32.DLL" in "rundll32.exe" "RemoveDirectoryW@KERNEL32.DLL" in "rundll32.exe" "LoadLibraryA@KERNEL32.DLL" in "rundll32.exe" "DecryptMessage@SSPICLI.DLL" in "rundll32.exe" "send@WS2_32.DLL" in "rundll32.exe" "Process32NextW@KERNEL32.DLL" in "rundll32.exe" "RemoveDirectoryA@KERNEL32.DLL" in "rundll32.exe" "CreateDirectoryA@KERNEL32.DLL" in "rundll32.exe"4e:T6f2,Found string "CMD=ENCD" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=NC_DATA" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=%s" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=CONNECT_REPLY" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=STATUS" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=CTL_CANCEL_CONNECT" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=MESSAGERECEIVED" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=MESSAGEACK" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=USERSTATUS" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=POLL" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=CTL_BROWSE" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=CTL_CONNECT" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=HANGUP" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=PUBLISHSERVICE" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=CLOSE" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=%s|%s" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=OPEN" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=ADDDOMAIN" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=REMOVEDOMAIN" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=LICENSEINFO" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=PUTFILE" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=PUTFILELINK" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=GETFILEINFO" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=ADDOPERATOR" (Indicator: "cmd="; File: "HTCTL32.DLL") Found string "CMD=REMOVEOPERATOR" (Indicator: "cmd="; File: "HTCTL32.DLL")4f:T1034,Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001248.00000000.238499.03140000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001264.00000000.235807.02F10000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001644.00000000.236578.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001704.00000000.244249.00500000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002452.00000000.239767.03290000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003044.00000000.245535.02FE0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003152.00000000.246490.03120000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003220.00000000.233886.008C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003636.00000000.233686.00700000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003784.00000000.241053.00920000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003836.00000000.237211.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004112.00000000.246057.03360000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004168.00000000.233359.03150000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004304.00000000.244136.03280000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004588.00000000.246201.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004840.00000000.244279.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005000.00000000.242008.00920000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005160.00000000.237845.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005292.00000000.239132.00800000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005792.00000000.241065.032B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007188.00000000.242214.00920000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007416.00000000.240293.00B20000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007616.00000000.237728.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007636.00000000.233363.00790000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007716.00000000.233369.00C20000.00000004.mdmp")50:T146c,Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 7716 -ip 7716" (UID: 00000000-00008104) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 4168 -ip 4168" (UID: 00000000-00008136) Spawned process "WerFault.exe" with commandline "-u -p 7716 -s 712" (UID: 00000000-00007948) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 7636 -ip 7636" (UID: 00000000-00007996) Spawned process "WerFault.exe" with commandline "-u -p 7716 -s 712" (UID: 00000000-00002564) Spawned process "WerFault.exe" with commandline "-u -p 7636 -s 712" (UID: 00000000-00003320) Spawned process "WerFault.exe" with commandline "-u -p 7636 -s 712" (UID: 00000000-00008048) Spawned process "WerFault.exe" with commandline "-u -p 7716 -s 712" (UID: 00000000-00006172) Spawned process "WerFault.exe" with commandline "-u -p 7636 -s 712" (UID: 00000000-00005876) Spawned process "WerFault.exe" with commandline "-u -p 4168 -s 704" (UID: 00000000-00002936) Spawned process "WerFault.exe" with commandline "-u -p 4168 -s 704" (UID: 00000000-00000160) Spawned process "WerFault.exe" with commandline "-u -p 4168 -s 704" (UID: 00000000-00006192) Spawned process "WerFault.exe" with commandline "-pss -s 456 -p 3636 -ip 3636" (UID: 00000000-00006184) Spawned process "WerFault.exe" with commandline "-u -p 3636 -s 712" (UID: 00000000-00004936) Spawned process "WerFault.exe" with commandline "-u -p 3636 -s 712" (UID: 00000000-00006944) Spawned process "WerFault.exe" with commandline "-u -p 3636 -s 712" (UID: 00000000-00000404) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 3220 -ip 3220" (UID: 00000000-00008168) Spawned process "WerFault.exe" with commandline "-u -p 3220 -s 708" (UID: 00000000-00004740) Spawned process "WerFault.exe" with commandline "-u -p 3220 -s 708" (UID: 00000000-00006928) Spawned process "WerFault.exe" with commandline "-u -p 3220 -s 708" (UID: 00000000-00004636) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8156 -ip 8156" (UID: 00000000-00007696) Spawned process "WerFault.exe" with commandline "-u -p 8156 -s 704" (UID: 00000000-00004912) Spawned process "WerFault.exe" with commandline "-u -p 8156 -s 704" (UID: 00000000-00004584) Spawned process "WerFault.exe" with commandline "-u -p 8156 -s 704" (UID: 00000000-00007928) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 7932 -ip 7932" (UID: 00000000-00007096) Spawned process "WerFault.exe" with commandline "-u -p 7932 -s 712" (UID: 00000000-00004304) Spawned process "WerFault.exe" with commandline "-u -p 7932 -s 712" (UID: 00000000-00007120) Spawned process "WerFault.exe" with commandline "-u -p 7932 -s 712" (UID: 00000000-00004760) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 1264 -ip 1264" (UID: 00000000-00004260) Spawned process "WerFault.exe" with commandline "-u -p 1264 -s 704" (UID: 00000000-00007448) Spawned process "WerFault.exe" with commandline "-u -p 1264 -s 704" (UID: 00000000-00007440) Spawned process "WerFault.exe" with commandline "-u -p 1264 -s 704" (UID: 00000000-00000380) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 1644 -ip 1644" (UID: 00000000-00002400) Spawned process "WerFault.exe" with commandline "-u -p 1644 -s 712" (UID: 00000000-00001956) Spawned process "WerFault.exe" with commandline "-u -p 1644 -s 712" (UID: 00000000-00002096) Spawned process "WerFault.exe" with commandline "-u -p 1644 -s 712" (UID: 00000000-00003764) Spawned process "WerFault.exe" with commandline "-pss -s 392 -p 3836 -ip 3836" (UID: 00000000-00006372) Spawned process "WerFault.exe" with commandline "-u -p 3836 -s 712" (UID: 00000000-00005916) Spawned process "WerFault.exe" with commandline "-u -p 3836 -s 712" (UID: 00000000-00005856) Spawned process "WerFault.exe" with commandline "-u -p 3836 -s 712" (UID: 00000000-00005864) Spawned process "WerFault.exe" with commandline "-pss -s 392 -p 7616 -ip 7616" (UID: 00000000-00007480) Spawned process "WerFault.exe" with commandline "-u -p 7616 -s 712" (UID: 00000000-00007220) Spawned process "WerFault.exe" with commandline "-u -p 7616 -s 712" (UID: 00000000-00003600) Spawned process "WerFault.exe" with commandline "-u -p 7616 -s 712" (UID: 00000000-00006644) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 5160 -ip 5160" (UID: 00000000-00005024) Spawned process "WerFault.exe" with commandline "-u -p 5160 -s 712" (UID: 00000000-00004244) Spawned process "WerFault.exe" with commandline "-u -p 5160 -s 712" (UID: 00000000-00007436) Spawned process "WerFault.exe" with commandline "-u -p 5160 -s 712" (UID: 00000000-00007924) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 1248 -ip 1248" (UID: 00000000-00000828) Spawned process "WerFault.exe" with commandline "-u -p 1248 -s 704" (UID: 00000000-00004856) Spawned process "WerFault.exe" with commandline "-u -p 1248 -s 704" (UID: 00000000-00006280) Spawned process "WerFault.exe" with commandline "-u -p 1248 -s 704" (UID: 00000000-00000032) Spawned process "WerFault.exe" with commandline "-pss -s 452 -p 5292 -ip 5292" (UID: 00000000-00006336) Spawned process "WerFault.exe" with commandline "-u -p 5292 -s 704" (UID: 00000000-00006884)51:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00004192-00000C15-1214039218 [PID: 4192] "rundll32.exe" queried SystemProcessInformation at 00000000-00004192-00000C15-1214046504 [PID: 4192] "rundll32.exe" queried SystemProcessInformation at 00000000-00004192-00000C15-1214569069 [PID: 4192] "rundll32.exe" queried SystemProcessInformation at 00000000-00004192-00000C15-1214576034 [PID: 4192] "rundll32.exe" queried SystemProcessInformation at 00000000-00006104-00000C15-1213819493 [PID: 6104] "rundll32.exe" queried SystemProcessInformation at 00000000-00006104-00000C15-1213837007 [PID: 6104] "rundll32.exe" queried SystemProcessInformation at 00000000-00006104-00000C15-1214463097 [PID: 6104] "rundll32.exe" queried SystemProcessInformation at 00000000-00006104-00000C15-1214470819 [PID: 6104] "rundll32.exe" queried SystemProcessInformation at 00000000-00006992-00000C15-1213973353 [PID: 6992] "rundll32.exe" queried SystemProcessInformation at 00000000-00006992-00000C15-1214005297 [PID: 6992] "rundll32.exe" queried SystemProcessInformation at 00000000-00006992-00000C15-1214770979 [PID: 6992] "rundll32.exe" queried SystemProcessInformation at 00000000-00006992-00000C15-1214790803 [PID: 6992] "rundll32.exe" queried SystemProcessInformation at 00000000-00008980-00000C15-1213952295 [PID: 8980] "rundll32.exe" queried SystemProcessInformation at 00000000-00008980-00000C15-1213983454 [PID: 8980] "rundll32.exe" queried SystemProcessInformation at 00000000-00008980-00000C15-1214546325 [PID: 8980] "rundll32.exe" queried SystemProcessInformation at 00000000-00008980-00000C15-1214553840 [PID: 8980] "rundll32.exe" queried SystemProcessInformation at 00000000-00004792-00000C15-1218550500 [PID: 4792] "rundll32.exe" queried SystemProcessInformation at 00000000-00004792-00000C15-1218558107 [PID: 4792] "rundll32.exe" queried SystemProcessInformation at 00000000-00004792-00000C15-1218996063 [PID: 4792] "rundll32.exe" queried SystemProcessInformation at 00000000-00004792-00000C15-1219004394 [PID: 4792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1219184166 [PID: 1368] "rundll32.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1219192609 [PID: 1368] "rundll32.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1219648412 [PID: 1368] "rundll32.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1219655728 [PID: 1368] "WerFault.exe" queried SystemProcessInformation at 00000000-00008596-00000C15-1324021992 [PID: 8596]52:Tcb5,Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00000184.00000001.154688.05030000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00000184.00000001.154688.05030000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00000396.00000000.149567.04180000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00000396.00000000.149567.04180000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00000888.00000000.146336.04ED0000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00000888.00000000.146336.04ED0000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001008.00000000.155065.04620000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001008.00000000.155065.04620000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001308.00000000.154373.043D0000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001308.00000000.154373.043D0000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001368.00000001.144134.04E70000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001368.00000001.144134.04E70000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001392.00000001.154736.04070000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001392.00000001.154736.04070000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001404.00000000.144094.049C0000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001404.00000000.144094.049C0000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001424.00000001.146069.04E00000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001424.00000001.146069.04E00000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001456.00000001.148001.04E60000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001456.00000001.148001.04E60000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00001548.00000000.144409.04AB0000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001548.00000000.144409.04AB0000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00002012.00000001.154441.04DE0000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00002012.00000001.154441.04DE0000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00002440.00000000.146021.04B30000.00000004.mdmp")53:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=54:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=55:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=56:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=57:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=58:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=59:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5c:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5d:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5e:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5f:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=60:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=61:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=62:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=63:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=64:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=65:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=66:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=67:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=68:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=69:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6c:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6d:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6e:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=6f:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=70:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=71:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=72:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=73:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=74:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=75:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=76:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=77:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=78:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=79:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7c:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7d:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7e:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=7f:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=80:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=81:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=82:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=83:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=84:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=85:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=86:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=87:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=88:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=89:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8c:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8d:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8e:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=8f:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=90:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=91:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=92:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=93:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=94:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=95:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=96:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=97:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=98:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=99:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=9a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=9b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 6562585009f1… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 6562585009f1…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"HTCTL32.DLL\",\"applicationCategory\":[\"pedll\",\"executable\"],\"identifier\":\"6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":1,\"suspicious\":19},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794413423944,"unified_at":"2026-11-11T16:10:23.944Z","metadata":{"hashes":{"sha256":"6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269","sha1":"38c171457d160f8a6f26baa668f5c302f6c29cd1","md5":"051cdb6ac8e168d178e35489b6da4c74","sha512":"602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36","ssdeep":"6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85","ssdeep_chunks":["6144:WyspIr8","6144:yspIr8g","6144:spIr8g8","6144:pIr8g8i","6144:Ir8g8im","6144:r8g8ime","6144:8g8imeK","6144:g8imeKk","6144:8imeKk9","6144:imeKk9F","6144:meKk9Fv","6144:eKk9Fv8","6144:Kk9Fv8T","6144:k9Fv8Ta","6144:9Fv8Tam","6144:Fv8Tamd","6144:v8TamdF","6144:8TamdF3","6144:TamdF3x","6144:amdF3xu","6144:mdF3xuH","6144:dF3xuHG","6144:F3xuHGA","6144:3xuHGAi","6144:xuHGAim","6144:uHGAimn","6144:HGAimnx","6144:GAimnx3","6144:Aimnx30","6144:imnx30a","6144:mnx30aa","6144:nx30aaY","6144:x30aaY5","6144:30aaY5n","6144:0aaY5nF","6144:aaY5nFJ","6144:aY5nFJl","6144:Y5nFJl8","6144:5nFJl8N","6144:nFJl8Nj","6144:FJl8Njz","6144:Jl8NjzG","6144:l8NjzGr","6144:8NjzGrn","6144:NjzGrn0","6144:jzGrn0J","6144:zGrn0J/","6144:Grn0J/d","6144:rn0J/d3","6144:n0J/d3M","6144:0J/d3M1","6144:J/d3M1O","6144:/d3M1OG","6144:d3M1OGg","12288:WyspIr8","12288:yspIr8g","12288:spIr8g8","12288:pIr8g8i","12288:Ir8g8im","12288:r8g8ime","12288:8g8imeK","12288:g8imeKk","12288:8imeKk9","12288:imeKk9F","12288:meKk9Fv","12288:eKk9Fv8","12288:Kk9Fv8T","12288:k9Fv8Ta","12288:9Fv8Tam","12288:Fv8Tamd","12288:v8TamdF","12288:8TamdF3","12288:TamdF3x","12288:amdF3xu","12288:mdF3xuH","12288:dF3xuHG","12288:F3xuHGA","12288:3xuHGAi","12288:xuHGAim","12288:uHGAimn","12288:HGAimnx","12288:GAimnx3","12288:Aimnx30","12288:imnx30a","12288:mnx30aa","12288:nx30aaY","12288:x30aaY5","12288:30aaY5n","12288:0aaY5nF","12288:aaY5nFJ","12288:aY5nFJl","12288:Y5nFJl8","12288:5nFJl8N","12288:nFJl8Nj","12288:FJl8Njz","12288:Jl8NjzG","12288:l8NjzGr","12288:8NjzGrn","12288:NjzGrn0","12288:jzGrn0J","12288:zGrn0J/","12288:Grn0J/d","12288:rn0J/d3","12288:n0J/d3M","12288:0J/d3M1","12288:J/d3M1O","12288:/d3M1OG","12288:d3M1OGg","6144:Ir8g8i1","6144:r8g8i19","6144:8g8i191","6144:g8i191u","6144:8i191uz","6144:i191uzd","6144:191uzdw","6144:91uzdwH","6144:1uzdwHG","6144:uzdwHGA","6144:zdwHGAi","6144:dwHGAim","6144:wHGAimd","6144:HGAimd0","6144:GAimd0b","6144:Aimd0bY","6144:imd0bY5","6144:md0bY5F","6144:d0bY5FJ","6144:0bY5FJl","6144:bY5FJl8","6144:Y5FJl85"],"imphash":"d6b575f0ed1aac804361e85aeef8d94c"},"file_info":{"file_name":"HTCTL32.DLL","file_type":["pedll","executable"],"file_type_id":"dll","file_size":323912,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692508609000,"last_seen":1773732496000,"last_multi_scan":1773732496000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":164,"suspicious_count":19,"malicious_count":1,"total":184},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Hooks key cryptographic functions of the CryptoAPI"},{"type":"informative","value":"Hooks API calls"},{"type":"suspicious","value":"Hooks file system APIs"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"},{"type":"suspicious","value":"Calls an API typically used to retrieve the host name of a computer"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"suspicious","value":"Contains ability to discover system user information"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"References HTTP requests in memory"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"suspicious","value":"Found POST request with headers in memory"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"HTCTL32.DLL\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"HTCTL32.DLL\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"HTCTL32.DLL\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"HTCTL32.DLL\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"HTCTL32.DLL\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"HTCTL32.DLL\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Hooks key cryptographic functions of the CryptoAPI\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"*CurrentUserName\" (Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"HTCTL32.DLL\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"HTCTL32.DLL\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003796-00000C2C-3126816527\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003796-00000C2C-3126818000\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003796-00000C2C-3126819555\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"HTCTL32.DLL\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"HTCTL32.DLL\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"HTCTL32.DLL\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; File: \"HTCTL32.DLL\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003380)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003352)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00001448)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002700)\n \"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002700)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003892)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"rundll32.exe\" called \"IsWow64Process\" with parameter \"3796\" - (UID: 00000000-00003796)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002700)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003764)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000676)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002776)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002536)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001260)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$3d","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 50271-458-101C7030\n GetTickCount@KERNEL32.dll at 50271-501-101C4F30\n GetTickCount@KERNEL32.dll at 50271-1194-101C6940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 50271-1346-101B78E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 50271-1196-101B9160","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 50271-1866-101E21E8\n EnumSystemLocalesA@KERNEL32.dll at 50271-1867-101E21AC\n EnumSystemLocalesA@KERNEL32.dll at 50271-1869-101E2145\n GetLocaleInfoW@KERNEL32.dll at 50271-1873-101E1C91\n GetLocaleInfoA@KERNEL32.dll at 50271-1948-101E1D88\n GetLocaleInfoW@KERNEL32.dll at 50271-1950-101E1E2F\n GetLocaleInfoA@KERNEL32.dll at 50271-1953-101E205B\n GetUserDefaultLCID@KERNEL32.dll at 50271-2863-101E1C7D\n EnumSystemLocalesA@KERNEL32.dll at 50271-2890-101E2119","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WerFault.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Is247=%d\" (Indicator: \"set \"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"jne 101B91BBh\" at 50271-1196-101B9160","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\nsmsrc\\nsm\\1201\\1201F2\\ctl32\\release\\htctl32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001348.00000000.268697.002D0000.00000004.mdmp\")\n Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002236.00000001.266583.002A0000.00000004.mdmp\")\n Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002804.00000000.266765.001C0000.00000004.mdmp\")\n Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003328.00000000.267240.00380000.00000004.mdmp\")\n Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003336.00000000.261514.00260000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 50271-498-101C55A0\n Sleep@KERNEL32.dll at 50271-499-101C5170\n Sleep@KERNEL32.dll at 50271-521-101C46E0\n Sleep@KERNEL32.dll at 50271-522-101C4500\n Sleep@KERNEL32.dll at 50271-523-101C42B0\n WaitForSingleObject@KERNEL32.dll at 50271-530-101BEEA0\n WaitForSingleObject@KERNEL32.dll at 50271-896-101D0360\n WaitForSingleObject@KERNEL32.dll at 50271-902-101CDA30\n WaitForSingleObject@KERNEL32.dll at 50271-907-101CFFA0\n WaitForSingleObject@KERNEL32.dll at 50271-1039-101CDB20\n Sleep@KERNEL32.dll at 50271-1191-101C6BA0\n Sleep@KERNEL32.dll at 50271-1349-101B63A0\n Sleep@KERNEL32.dll at 50271-1915-101DD347\n Sleep@KERNEL32.dll at 50271-1917-101DD461","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: HTCTL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 50271-458-101C7030\n LoadLibraryA@KERNEL32.dll at 50271-892-101D0950\n LoadLibraryA@KERNEL32.dll at 50271-1185-101C8140\n LoadLibraryA@KERNEL32.dll at 50271-1186-101C7F80\n LoadLibraryA@KERNEL32.dll at 50271-1360-101B4A90\n LoadLibraryA@KERNEL32.dll at 50271-1435-101B3020\n LoadLibraryA@KERNEL32.dll at 50271-1485-101B4A40\n LoadLibraryA@KERNEL32.dll at 50271-1600-101D0F60\n LoadLibraryW@KERNEL32.dll at 50271-1931-101DF9C1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; File: \"HTCTL32.DLL\")\n Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"HTCTL32.DLL\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"HTCTL32.DLL\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"HTCTL32.DLL\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"HTCTL32.DLL\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"HTCTL32.DLL\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$40","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"rundll32.exe\" created multiple process\n \"WerFault.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process rundll32.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n Process rundll32.exe created mutex with name \"DBWinMutex\"\n Process WerFault.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"rundll32.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"rundll32.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"WerFault.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"WerFault.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"HTCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; File: \"HTCTL32.DLL\")\n Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F50000\n \"WerFault.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e001022876b@KERNELBASE.dll\"\n \"15001600b09e946b@ADVAPI32.dll\"\n \"0e000f00609f946b@ADVAPI32.dll\"\n \"0e000f00bc9f946b@ADVAPI32.dll\"\n \"11001200e0a7946b@ADVAPI32.dll\"\n \"1100120074a8946b@ADVAPI32.dll\"\n \"12001300b8a8946b@ADVAPI32.dll\"\n \"1200130010a9946b@ADVAPI32.dll\"\n \"1400150058d7946b@ADVAPI32.dll\"\n \"1400150070d7946b@ADVAPI32.dll\"\n \"1400150088d7946b@ADVAPI32.dll\"\n \"17001800a0d7946b@ADVAPI32.dll\"\n \"0d000e00b8d7946b@ADVAPI32.dll\"\n \"11001200c8d7946b@ADVAPI32.dll\"\n \"11001200dcd7946b@ADVAPI32.dll\"\n \"0d000e0060a9946b@SHELL32.dll\"\n \"0d000e00dca9946b@SHELL32.dll\"\n \"0f0010001cd9946b@ADVAPI32.dll\"\n \"140015005cd9946b@ADVAPI32.dll\"\n \"1400150074d9946b@ADVAPI32.dll\"\n \"0c000d00bcd9946b@ADVAPI32.dll\"\n \"0c000d00ccd9946b@ADVAPI32.dll\"\n \"0e000f00dcd9946b@ADVAPI32.dll\"\n \"0e000f00ecd9946b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"HTCTL32.DLL\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"HTCTL32.DLL\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"HTCTL32.DLL\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"HTCTL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"HTCTL32.DLL\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"HTCTL32.DLL\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"HTCTL32.DLL\" file has an entrypoint instructions - \"mov\tedi, edi,push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x101d5ac6,call\t0x101df25d,push\tdword ptr [ebp + 8],mov\tecx, dword ptr [ebp + 0x10],mov\tedx, dword ptr [ebp + 0xc],call\t0x101d59c0,pop\tecx,pop\tebp,ret\t0xc,mov\tedi, edi,push\tebp,mov\tebp, esp,push\t0x101f33b8,call\tdword ptr [0x101f01c0],test\teax, eax,je\t0x101d5b02,push\t0x101f33a8,push\teax,call\tdword ptr [0x101f0088],test\teax, eax,je\t0x101d5b02,push\tdword ptr [ebp + 8],call\teax,pop\tebp,ret\t,mov\tedi, edi,push\tebp,mov\tebp, esp,push\tdword ptr [ebp + 8],call\t0x101d5ad9,pop\tecx,push\tdword ptr [ebp + 8],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\rundll32.exe\" [Source: 00000000-00001448-00000C66-3002898733]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00003352) was launched with new environment variables: \"USERDNSDOMAIN=\"rOfGi5fGXi\"\"\n Process \"rundll32.exe\" (UID: 00000000-00003352) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003380-00000C2B-3001550291]\n Observed system executable string:\"C:\\Windows\\system32\\apphelp.dll\" [Source: 00001248.000004E0.200817308.00050000.wprm]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$45","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"HTCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"HTCTL32.DLL\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"HTCTL32.DLL\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.dll at 50271-1196-101B9160","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\sspicli.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"WerFault.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\WSOCK32.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.124.MANIFEST\"\n \"WerFault.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.MANIFEST\"\n \"WerFault.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.123.MANIFEST\"\n \"WerFault.exe\" trying to access non-existent file \"C:\\HTCTL32.DLL.124.MANIFEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"HTCTL32.DLL\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"HTCTL32.DLL\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"CLIENT_IP_ADDRESS=0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://%s/fakeurl.htm\"\n Pattern match: \"http://%s/testpage.htm\"\n Pattern match: \"http://ocsp.thawte.com0\"\n Pattern match: \"http://crl.thawte.com/thawtetimestampingca.crl0\"\n Pattern match: \"http://ts-ocsp.ws.symantec.com07\"\n Pattern match: \"http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\"\n Pattern match: \"http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\"\n Pattern match: \"https://www.verisign.com/rpa\"\n Pattern match: \"http://sf.symcb.com/sf.crl0f\"\n Pattern match: \"https://d.symcb.com/cps0%\"\n Pattern match: \"https://d.symcb.com/rpa0\"\n Pattern match: \"http://sf.symcd.com0&\"\n Pattern match: \"http://sf.symcb.com/sf.crt0\"\n Pattern match: \"https://www.verisign.com/cps0*\"\n Pattern match: \"https://www.verisign.com/rpa0\"\n Pattern match: \"http://logo.verisign.com/vslogo.gif04\"\n Pattern match: \"http://crl.verisign.com/pca3-g5.crl04\"\n Pattern match: \"http://ocsp.verisign.com0\"\n Pattern match: \"http://www.netsupportsoftware.com\"\n Heuristic match: \"js;.jse;.wsf;.ws\"\n Heuristic match: \"se;.wsf;.ws\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://%s/fakeurl.htm\" - Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found URL \"http://%s/testpage.htmwininet.dllcontent-length:http/sendernclen\" - Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST http://%s/fakeurl.htm HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"HTCTL32.DLL\")\n Found string \"CONNECT %s:%d HTTP/1.1Host:%s:%d%s\" (Indicator: \"HTTP/1.1\"; File: \"HTCTL32.DLL\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"HTCTL32.DLL\")\n Found string \"POST http://%s/fakeurl.htm HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"CONNECT %s:%d HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"\n Found HTTPS url \"https://d.symcb.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"rundll32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64.cpp\" (Indicator: \"base64\"; File: \"HTCTL32.DLL\")\n Found string \"base64.cpp\" (Indicator: \"base64\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"HTCTL32.DLL\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"HTCTL32.DLL\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; File: \"HTCTL32.DLL\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; File: \"HTCTL32.DLL\")\n Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"HTCTL32.DLL\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"HTCTL32.DLL\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001348.00000000.268697.002D0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002236.00000001.266583.002A0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002804.00000000.266765.001C0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003328.00000000.267240.00380000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003336.00000000.261514.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"HTCTL32.DLL\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"HTCTL32.DLL\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: HTCTL32.DLL","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"HTCTL32.DLL\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003380.00000000.256304.00911000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"HTCTL32.DLL\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"$4d","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: HTCTL32.DLL]\n Observed import api \"ImpersonateLoggedOnUser\" which can \"let the calling thread impersonate the security context of a logged-on user\" [Source: HTCTL32.DLL]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"HTCTL32.DLL\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"HTCTL32.DLL\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"HTCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"OutputDebugStringA@KERNEL32.dll at 50271-1190-101C7810\n OutputDebugStringA@KERNEL32.dll at 50271-1193-101B97C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Hooks file system APIs","description":"\"FindFirstFileA@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"EncryptMessage@SSPICLI.DLL\" in \"rundll32.exe\"\n \"DecryptMessage@SSPICLI.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to discover system user information","description":"Observed user discovery api used in \"advapi32.dll\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1033","relevance":3,"id":"static-212","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 50271-458-101C7030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 50271-2492-101EE7D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00001348.00000000.268697.00920000.00000002.mdmp\n \"Progman\" (Program manager) in Source: 00000000-00001348.00000000.268697.00920000.00000002.mdmp\n \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00003568.00000000.262782.00920000.00000002.mdmp\n \"Progman\" (Program manager) in Source: 00000000-00003568.00000000.262782.00920000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Network Related","name":"Found POST request with headers in memory","description":"Found HTTP POST request \"('POST http://%s/fakeurl.htm HTTP/1.1\\nCONNECTION_ID\\nSERVER_VERSION\\nPROTOCOL_VER\\nFAILED_REASON\\nCLIENT_NAME\\nRESULT\\nCloseGatewayConnection - closesocket(%u) FAILED (%d)\\nCloseGatewayConnection - shutdown(%u) FAILED (%d)\\nCannot resolve hostname %s, error %d\\nCONFIG_UPDATE - comms manage packet interval: %u secs\\nCMPI\\nERROR\\nLICENSE\\nhttp://%s/testpage.htm\\nwininet.dll\\nContent-Length:\\nHTTP/\\nSENDER\\nnclen == datalen\\ne:\\\\nsmsrc\\\\nsm\\\\1201\\\\1201f2\\\\ctl32\\\\htctl.c\\nDATA\\nFROM\\nFLAGS\\n*Blocki.............\" in memory - Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1041","relevance":5,"id":"memorydump-7","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Network Related","name":"References HTTP requests in memory","description":"Found HTTP requests \"POST http://%s/fakeurl.htm HTTP/1.1\" in memory - Source: \"00000000-00002484.00000000.258921.6B330000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":3,"id":"memorydump-6","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect netsupport_manager RMM tool file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.dll at 50271-458-101C7030","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 50271-2656-101D899E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameA\n OpenProcessToken\n GetFileSize\n TerminateProcess\n OpenProcess\n GetCommandLineA\n GetTempPathA\n CreateThread\n UnhandledExceptionFilter\n CopyFileA\n GetModuleHandleW\n LoadLibraryW\n GetModuleFileNameA\n GetTickCount\n GetModuleFileNameW\n GetVersionExA\n GetModuleHandleA\n LoadLibraryA\n IsDebuggerPresent\n OutputDebugStringA\n WriteFile\n CreateFileA\n Sleep\n CreateFileW\n GetProcAddress\n GetStartupInfoW\n closesocket\n recv\n socket\n WSAStartup\n send\n connect\n bind","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"},{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"HTCTL32.DLL\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007188.00000000.242214.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004168)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007636)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004452)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007716)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003636)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003220)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004540)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008156)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007932)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00007188.00000000.242214.00DC9000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00007188.00000000.242214.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; File: \"HTCTL32.DLL\")\n Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74980000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72770000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74980000\n \"WerFault.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72770000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4168)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\".sm}.sm|.smx.smz.smd.sm{.sme.smg.smf.smb.sma.sm`.smm.sml.smc.smh.smo.smn.smk.smj.smi.sm\" [Source: 00000000-00004588.00000000.246201.00BB0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"HTCTL32.DLL\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00007188.00000000.242214.00DC9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WerFault.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"HTCTL32.DLL\" has section name .text with entropy \"6.576271021181248\"\n \"HTCTL32.DLL\" has section name .data with entropy \"6.1869129702869055\"\n \"HTCTL32.DLL\" has section name .reloc with entropy \"6.717901499716829\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"rundll32.exe queries ProcessDebugPort (UID: 4168), \"rundll32.exe queries ProcessDebugPort (UID: 7636)\n \"rundll32.exe queries ProcessDebugPort (UID: 7716), \"rundll32.exe queries ProcessDebugPort (UID: 3636)\n \"rundll32.exe queries ProcessDebugPort (UID: 3220), \"rundll32.exe queries ProcessDebugPort (UID: 8156)\n \"rundll32.exe queries ProcessDebugPort (UID: 7932), \"WerFault.exe queries ProcessDebugPort (UID: 4304)\n \"rundll32.exe queries ProcessDebugPort (UID: 1264), \"rundll32.exe queries ProcessDebugPort (UID: 1644)\n \"rundll32.exe queries ProcessDebugPort (UID: 3836), \"rundll32.exe queries ProcessDebugPort (UID: 7616)\n \"rundll32.exe queries ProcessDebugPort (UID: 5160)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"rundll32.exe\" called \"gethostname\" (UID: 00000000-00001980)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; File: \"HTCTL32.DLL\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; File: \"HTCTL32.DLL\")\n Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; Source: \"00000000-00005792.00000000.241065.721E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$51","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001392.00000001.154736.0005A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"$52","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00008320\"\n YARA signature to detect medium entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00008320\"\n YARA signature for RC4 encryption matched on process \"00000000-00001456\"\n YARA signature for RC4 encryption matched on process \"00000000-00006748\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"rundll32.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00000184.00000001.154688.05030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"685c753cb873551af5062672"},{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]}]},"activity":{"stats":{"process_count":156,"spawned_processes_count":156,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":68,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"69b9028f586b25cbc1011ce4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"HTCTL32.DLL","analysis_start_time":"2026-03-17T07:28:16+00:00","indicators_count":{"informative":141,"suspicious":15,"malicious":0},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"68f21e89a6481108bb026d11","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"HTCTL32.DLL","analysis_start_time":"2025-10-17T10:46:34+00:00","indicators_count":{"informative":138,"suspicious":24,"malicious":1},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"685c753cb873551af5062672","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"HTCTL32.DLL","analysis_start_time":"2025-06-25T22:16:29+00:00","indicators_count":{"informative":124,"suspicious":20,"malicious":1},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}],"processes":[{"pid":8604,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00008604"},{"pid":4192,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#1","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004192","icon":"$53"},{"pid":2736,"ppid":4192,"name":"WerFault.exe","command_line":"-u -p 4192 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004192","uid":"00000000-00002736"},{"pid":4128,"ppid":4192,"name":"WerFault.exe","command_line":"-u -p 4192 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004192","uid":"00000000-00004128"},{"pid":7744,"ppid":4192,"name":"WerFault.exe","command_line":"-u -p 4192 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004192","uid":"00000000-00007744"},{"pid":6104,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#3","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006104","icon":"$54"},{"pid":6992,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#2","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006992","icon":"$55"},{"pid":6924,"ppid":6992,"name":"WerFault.exe","command_line":"-u -p 6992 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006992","uid":"00000000-00006924"},{"pid":5172,"ppid":6992,"name":"WerFault.exe","command_line":"-u -p 6992 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006992","uid":"00000000-00005172"},{"pid":5008,"ppid":6992,"name":"WerFault.exe","command_line":"-u -p 6992 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006992","uid":"00000000-00005008"},{"pid":8980,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#4","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008980","icon":"$56"},{"pid":4736,"ppid":8980,"name":"WerFault.exe","command_line":"-u -p 8980 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008980","uid":"00000000-00004736"},{"pid":4312,"ppid":8980,"name":"WerFault.exe","command_line":"-u -p 8980 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008980","uid":"00000000-00004312"},{"pid":8672,"ppid":8980,"name":"WerFault.exe","command_line":"-u -p 8980 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008980","uid":"00000000-00008672"},{"pid":3792,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 4192 -ip 4192","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003792","icon":"$57"},{"pid":3976,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 488 -p 6992 -ip 6992","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003976","icon":"$58"},{"pid":4396,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 436 -p 8980 -ip 8980","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004396","icon":"$59"},{"pid":4792,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#5","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004792","icon":"$5a"},{"pid":7220,"ppid":4792,"name":"WerFault.exe","command_line":"-u -p 4792 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004792","uid":"00000000-00007220"},{"pid":2556,"ppid":4792,"name":"WerFault.exe","command_line":"-u -p 4792 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004792","uid":"00000000-00002556"},{"pid":7392,"ppid":4792,"name":"WerFault.exe","command_line":"-u -p 4792 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004792","uid":"00000000-00007392"},{"pid":1368,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#6","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001368","icon":"$5b"},{"pid":8596,"ppid":1368,"name":"WerFault.exe","command_line":"-u -p 1368 -s 552","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001368","uid":"00000000-00008596"},{"pid":2264,"ppid":1368,"name":"WerFault.exe","command_line":"-u -p 1368 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001368","uid":"00000000-00002264"},{"pid":5572,"ppid":1368,"name":"WerFault.exe","command_line":"-u -p 1368 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001368","uid":"00000000-00005572"},{"pid":424,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 436 -p 4792 -ip 4792","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000424","icon":"$5c"},{"pid":1488,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 1368 -ip 1368","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001488","icon":"$5d"},{"pid":8492,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#7","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008492","icon":"$5e"},{"pid":1404,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#8","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001404","icon":"$5f"},{"pid":516,"ppid":1404,"name":"WerFault.exe","command_line":"-u -p 1404 -s 536","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001404","uid":"00000000-00000516"},{"pid":4816,"ppid":1404,"name":"WerFault.exe","command_line":"-u -p 1404 -s 536","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001404","uid":"00000000-00004816"},{"pid":1912,"ppid":1404,"name":"WerFault.exe","command_line":"-u -p 1404 -s 536","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001404","uid":"00000000-00001912"},{"pid":2360,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 1404 -ip 1404","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002360","icon":"$60"},{"pid":1548,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#9","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001548","icon":"$61"},{"pid":740,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00000740"},{"pid":8340,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00008340"},{"pid":3124,"ppid":1548,"name":"WerFault.exe","command_line":"-u -p 1548 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001548","uid":"00000000-00003124"},{"pid":2676,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#10","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002676","icon":"$62"},{"pid":1424,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#11","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001424","icon":"$63"},{"pid":8576,"ppid":1424,"name":"WerFault.exe","command_line":"-u -p 1424 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001424","uid":"00000000-00008576"},{"pid":5028,"ppid":1424,"name":"WerFault.exe","command_line":"-u -p 1424 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001424","uid":"00000000-00005028"},{"pid":4540,"ppid":1424,"name":"WerFault.exe","command_line":"-u -p 1424 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001424","uid":"00000000-00004540"},{"pid":1636,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 1548 -ip 1548","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001636","icon":"$64"},{"pid":2072,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 1424 -ip 1424","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002072","icon":"$65"},{"pid":6956,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#12","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006956","icon":"$66"},{"pid":9024,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#13","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00009024","icon":"$67"},{"pid":4032,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#14","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004032","icon":"$68"},{"pid":6284,"ppid":4032,"name":"WerFault.exe","command_line":"-u -p 4032 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004032","uid":"00000000-00006284"},{"pid":4420,"ppid":4032,"name":"WerFault.exe","command_line":"-u -p 4032 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004032","uid":"00000000-00004420"},{"pid":2292,"ppid":4032,"name":"WerFault.exe","command_line":"-u -p 4032 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004032","uid":"00000000-00002292"},{"pid":184,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 4032 -ip 4032","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000184","icon":"$69"},{"pid":7356,"ppid":184,"name":"WerFault.exe","command_line":"-u -p 184 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000184","uid":"00000000-00007356"},{"pid":5372,"ppid":184,"name":"WerFault.exe","command_line":"-u -p 184 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000184","uid":"00000000-00005372"},{"pid":8952,"ppid":184,"name":"WerFault.exe","command_line":"-u -p 184 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000184","uid":"00000000-00008952"},{"pid":2440,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#15","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002440","icon":"$6a"},{"pid":8472,"ppid":2440,"name":"WerFault.exe","command_line":"-u -p 2440 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002440","uid":"00000000-00008472"},{"pid":4832,"ppid":2440,"name":"WerFault.exe","command_line":"-u -p 2440 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002440","uid":"00000000-00004832"},{"pid":8784,"ppid":2440,"name":"WerFault.exe","command_line":"-u -p 2440 -s 544","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002440","uid":"00000000-00008784"},{"pid":1384,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 2440 -ip 2440","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001384","icon":"$6b"},{"pid":888,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#16","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000888","icon":"$6c"},{"pid":1456,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#17","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001456","icon":"$6d"},{"pid":3440,"ppid":1456,"name":"WerFault.exe","command_line":"-u -p 1456 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001456","uid":"00000000-00003440"},{"pid":1196,"ppid":1456,"name":"WerFault.exe","command_line":"-u -p 1456 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001456","uid":"00000000-00001196"},{"pid":3196,"ppid":1456,"name":"WerFault.exe","command_line":"-u -p 1456 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001456","uid":"00000000-00003196"},{"pid":1444,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 1456 -ip 1456","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001444","icon":"$6e"},{"pid":4208,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#18","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004208","icon":"$6f"},{"pid":6288,"ppid":4208,"name":"WerFault.exe","command_line":"-u -p 4208 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004208","uid":"00000000-00006288"},{"pid":6964,"ppid":4208,"name":"WerFault.exe","command_line":"-u -p 4208 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004208","uid":"00000000-00006964"},{"pid":1408,"ppid":4208,"name":"WerFault.exe","command_line":"-u -p 4208 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004208","uid":"00000000-00001408"},{"pid":6596,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 420 -p 4208 -ip 4208","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006596","icon":"$70"},{"pid":8832,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#19","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008832","icon":"$71"},{"pid":2100,"ppid":8832,"name":"WerFault.exe","command_line":"-u -p 8832 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008832","uid":"00000000-00002100"},{"pid":4964,"ppid":8832,"name":"WerFault.exe","command_line":"-u -p 8832 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008832","uid":"00000000-00004964"},{"pid":5492,"ppid":8832,"name":"WerFault.exe","command_line":"-u -p 8832 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008832","uid":"00000000-00005492"},{"pid":6600,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 8832 -ip 8832","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006600","icon":"$72"},{"pid":4968,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#20","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004968","icon":"$73"},{"pid":6204,"ppid":4968,"name":"WerFault.exe","command_line":"-u -p 4968 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004968","uid":"00000000-00006204"},{"pid":2940,"ppid":4968,"name":"WerFault.exe","command_line":"-u -p 4968 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004968","uid":"00000000-00002940"},{"pid":7524,"ppid":4968,"name":"WerFault.exe","command_line":"-u -p 4968 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004968","uid":"00000000-00007524"},{"pid":4336,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 4968 -ip 4968","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004336","icon":"$74"},{"pid":3276,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#21","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003276","icon":"$75"},{"pid":6116,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#22","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006116","icon":"$76"},{"pid":3816,"ppid":6116,"name":"WerFault.exe","command_line":"-u -p 6116 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006116","uid":"00000000-00003816"},{"pid":8892,"ppid":6116,"name":"WerFault.exe","command_line":"-u -p 6116 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006116","uid":"00000000-00008892"},{"pid":1104,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 6116 -ip 6116","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001104","icon":"$77"},{"pid":3920,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#23","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003920","icon":"$78"},{"pid":7712,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#24","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007712","icon":"$79"},{"pid":7496,"ppid":7712,"name":"WerFault.exe","command_line":"-u -p 7712 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007712","uid":"00000000-00007496"},{"pid":5648,"ppid":7712,"name":"WerFault.exe","command_line":"-u -p 7712 -s 556","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007712","uid":"00000000-00005648"},{"pid":7364,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 7712 -ip 7712","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007364","icon":"$7a"},{"pid":396,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#26","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000396","icon":"$7b"},{"pid":6404,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#27","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006404","icon":"$7c"},{"pid":3932,"ppid":6404,"name":"WerFault.exe","command_line":"-u -p 6404 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006404","uid":"00000000-00003932"},{"pid":4720,"ppid":6404,"name":"WerFault.exe","command_line":"-u -p 6404 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006404","uid":"00000000-00004720"},{"pid":3360,"ppid":6404,"name":"WerFault.exe","command_line":"-u -p 6404 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006404","uid":"00000000-00003360"},{"pid":7812,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#28","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007812","icon":"$7d"},{"pid":7860,"ppid":7812,"name":"WerFault.exe","command_line":"-u -p 7812 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007812","uid":"00000000-00007860"},{"pid":4064,"ppid":7812,"name":"WerFault.exe","command_line":"-u -p 7812 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007812","uid":"00000000-00004064"},{"pid":1128,"ppid":7812,"name":"WerFault.exe","command_line":"-u -p 7812 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007812","uid":"00000000-00001128"},{"pid":5608,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 6404 -ip 6404","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005608","icon":"$7e"},{"pid":5844,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 7812 -ip 7812","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005844","icon":"$7f"},{"pid":7748,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#29","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007748","icon":"$80"},{"pid":8764,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#30","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008764","icon":"$81"},{"pid":4408,"ppid":8764,"name":"WerFault.exe","command_line":"-u -p 8764 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008764","uid":"00000000-00004408"},{"pid":2468,"ppid":8764,"name":"WerFault.exe","command_line":"-u -p 8764 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008764","uid":"00000000-00002468"},{"pid":1460,"ppid":8764,"name":"WerFault.exe","command_line":"-u -p 8764 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008764","uid":"00000000-00001460"},{"pid":4936,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 552 -p 8764 -ip 8764","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004936","icon":"$82"},{"pid":8320,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#31","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008320","icon":"$83"},{"pid":7768,"ppid":8320,"name":"WerFault.exe","command_line":"-u -p 8320 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008320","uid":"00000000-00007768"},{"pid":7832,"ppid":8320,"name":"WerFault.exe","command_line":"-u -p 8320 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008320","uid":"00000000-00007832"},{"pid":7952,"ppid":8320,"name":"WerFault.exe","command_line":"-u -p 8320 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008320","uid":"00000000-00007952"},{"pid":5704,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 8320 -ip 8320","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005704","icon":"$84"},{"pid":5948,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#32","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005948","icon":"$85"},{"pid":8588,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#33","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008588","icon":"$86"},{"pid":6888,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#34","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006888","icon":"$87"},{"pid":7232,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#35","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007232","icon":"$88"},{"pid":2576,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#36","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002576","icon":"$89"},{"pid":3848,"ppid":2576,"name":"WerFault.exe","command_line":"-u -p 2576 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002576","uid":"00000000-00003848"},{"pid":3696,"ppid":2576,"name":"WerFault.exe","command_line":"-u -p 2576 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002576","uid":"00000000-00003696"},{"pid":8788,"ppid":2576,"name":"WerFault.exe","command_line":"-u -p 2576 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002576","uid":"00000000-00008788"},{"pid":9156,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#37","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00009156","icon":"$8a"},{"pid":8852,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 2576 -ip 2576","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008852","icon":"$8b"},{"pid":6748,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#38","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006748","icon":"$8c"},{"pid":5260,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#39","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005260","icon":"$8d"},{"pid":2012,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#40","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002012","icon":"$8e"},{"pid":7684,"ppid":2012,"name":"WerFault.exe","command_line":"-u -p 2012 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002012","uid":"00000000-00007684"},{"pid":8448,"ppid":2012,"name":"WerFault.exe","command_line":"-u -p 2012 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002012","uid":"00000000-00008448"},{"pid":7292,"ppid":2012,"name":"WerFault.exe","command_line":"-u -p 2012 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002012","uid":"00000000-00007292"},{"pid":4256,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 2012 -ip 2012","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004256","icon":"$8f"},{"pid":2636,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 184 -ip 184","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002636","icon":"$90"},{"pid":1392,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#42","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001392","icon":"$91"},{"pid":1028,"ppid":1392,"name":"WerFault.exe","command_line":"-u -p 1392 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001392","uid":"00000000-00001028"},{"pid":8468,"ppid":1392,"name":"WerFault.exe","command_line":"-u -p 1392 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001392","uid":"00000000-00008468"},{"pid":3112,"ppid":1392,"name":"WerFault.exe","command_line":"-u -p 1392 -s 560","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001392","uid":"00000000-00003112"},{"pid":8732,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 1392 -ip 1392","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008732","icon":"$92"},{"pid":1308,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#43","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001308","icon":"$93"},{"pid":5848,"ppid":1308,"name":"WerFault.exe","command_line":"-u -p 1308 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001308","uid":"00000000-00005848"},{"pid":6988,"ppid":1308,"name":"WerFault.exe","command_line":"-u -p 1308 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001308","uid":"00000000-00006988"},{"pid":7828,"ppid":1308,"name":"WerFault.exe","command_line":"-u -p 1308 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001308","uid":"00000000-00007828"},{"pid":5544,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 628 -p 1308 -ip 1308","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005544","icon":"$94"},{"pid":5724,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#44","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005724","icon":"$95"},{"pid":7032,"ppid":5724,"name":"WerFault.exe","command_line":"-u -p 5724 -s 504","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005724","uid":"00000000-00007032"},{"pid":4728,"ppid":5724,"name":"WerFault.exe","command_line":"-u -p 5724 -s 504","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005724","uid":"00000000-00004728"},{"pid":6160,"ppid":5724,"name":"WerFault.exe","command_line":"-u -p 5724 -s 504","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005724","uid":"00000000-00006160"},{"pid":4928,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 636 -p 5724 -ip 5724","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004928","icon":"$96"},{"pid":4544,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#45","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004544","icon":"$97"},{"pid":1008,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#46","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001008","icon":"$98"},{"pid":5512,"ppid":1008,"name":"WerFault.exe","command_line":"-u -p 1008 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001008","uid":"00000000-00005512"},{"pid":4596,"ppid":1008,"name":"WerFault.exe","command_line":"-u -p 1008 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001008","uid":"00000000-00004596"},{"pid":1448,"ppid":1008,"name":"WerFault.exe","command_line":"-u -p 1008 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001008","uid":"00000000-00001448"},{"pid":3720,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 636 -p 1008 -ip 1008","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003720","icon":"$99"},{"pid":3588,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\HTCTL32.DLL\",#47","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003588","icon":"$9a"},{"pid":5832,"ppid":3588,"name":"WerFault.exe","command_line":"-u -p 3588 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003588","uid":"00000000-00005832"},{"pid":8012,"ppid":3588,"name":"WerFault.exe","command_line":"-u -p 3588 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003588","uid":"00000000-00008012"},{"pid":8412,"ppid":3588,"name":"WerFault.exe","command_line":"-u -p 3588 -s 552","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003588","uid":"00000000-00008412"},{"pid":2476,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 3588 -ip 3588","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002476","icon":"$9b"}],"all_imported_dlls":["api-ms-win-downlevel-advapi32-l1-1-0.dll","user32.dll","msvcrt.dll","rpcrt4.dll","userenv.dll","profapi.dll","wsock32.dll","iertutil.dll","sechost.dll","sspicli.dll","ws2_32.dll","nsi.dll","normaliz.dll","winmm.dll","fltLib.dll","imagehlp.dll","AcLayers.dll","uxtheme.dll","lpk.dll","dwmapi.dll","wininet.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","shell32.dll","ole32.dll","mpr.dll","imm32.dll","msctf.dll","psapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","apphelp.dll","KernelBase.dll","gdi32.dll","advapi32.dll","shlwapi.dll","HTCTL32.DLL","VxSSL32.dll","api-ms-win-downlevel-version-l1-1-0.dll","kernel32.dll","usp10.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","version.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","cryptbase.dll","cryptsp.dll","bcryptprimitives.dll","sfc_os.dll","cfgmgr32.dll","bcrypt.dll","wow64win.dll","ucrtbase.dll","windows.storage.dll","powrprof.dll","sfc.dll","wow64.dll","win32u.dll","combase.dll","setupapi.dll","gdi32full.dll","SHCore.dll","kernel.appcore.dll","IPHLPAPI.DLL","wow64cpu.dll","msvcp_win.dll","winmmbase.dll","wow64base.dll","wow64con.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68f21e89a6481108bb026d11"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"69b9028f586b25cbc1011ce4"}]}]}},"report_ids":{"sandbox_job_ids":["69b9028f586b25cbc1011ce4","68f21e89a6481108bb026d11","685c753cb873551af5062672"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 6562585009f1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 6562585009f1…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269"}],["$","meta","4",{"property":"og:title","content":"Sample 6562585009f1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 6562585009f1…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 6562585009f1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 6562585009f1…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L9c","11",{}]] 32:null