26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 88fc0ee92874… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 88fc0ee92874…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522"],"about":{"@type":"SoftwareApplication","name":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp")28:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp")29:T75a,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp")2a:T4ee,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2444483030 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2444491025 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2444682208 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2444689887 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2446006363 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2446016309 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2446356149 [PID: 6644] "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" queried SystemProcessInformation at 00000000-00006644-00000C15-2446365054 [PID: 6644]2b:T91b,Found XOR loop in file "sample.bin" at offset 246621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 246916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 247706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 262996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 317661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 398540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 666805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 237196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 259703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 495568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 687144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 747729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 47373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 47397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 177586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 216187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 244702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 246637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 370269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 417939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 438429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 452299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 540467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 645261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 684974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 783966; code bytes = 80302c:T101e,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000001997028964e03f75d8eb8f00687db273d8f38f0050187772cd9cf5fbfefffffff4f28f00d27c757298f28f000000d97490f38f00eb7c7572e0df3f7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000020f38f000000000008000000000000000000000000000000000000000000000000000000e19702890000000060f38f0069927674ffffffff3400000020f38f0008000000000000000000d97490f38f002794767428f38f000b0000000000000078f38f00 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000000000001e02ac004e02ac00402000000000000002800000000000000e82ac004082ec004a3010f7779000139feffffff0000c0046002c00400000000000000050000000028000000020000006002c00428000000280000002800000028000000000000000000000078e58f00506a1277e1c0684efeffffff00e58f00b7160f771c00000028000000a802c004ece48f00040718710000c0040000000028000000000000000000000005000000030000000000c0041c000000000000008802c00420e58f00ee130f771c000000ee130f7700000000000000001c000000ffffffff40e58f005072ca740000c004000000001c00000004071871 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000e7710713f0710713f0700000000c033c004208c3e07686b3f0719000000308c3e074600150050f50e7760693e0760693e0700000000ef0e937c786ec004905f3e071c000000886ec0040d001e0050f50e7760343f0760343f070000000010713f07588b3e07d0323f070b000000688b3e0704000b0000080b0764000000a70e937c60693e0760693e0700000000feffffff8470ca7498e58f006570ca740000c004000000008470ca74530e937c60343f0760343f0700000000e32e147160693e07b5ce1071fab033b860e58f00176f1171f4e58f0070c8cb74eb99cc08feffffff8470ca740a8e137160343f07f08d1371c0e58f00a7ce107101000000 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000e77b8713f07b8713f070000000000000000208c3e07686b3f071c00000050f50e7728623e0728623e07000000008470ca74786ec004905f3e0707000000886ec0040d001a00a80b0b076400000050f50e77e0343f07e0343f0700000000b8713f07588b3e07d0323f070f000000688b3e0704000f0000080b076400000028623e0728623e0700000000feffffff8470ca7494e58f006570ca740000c004000000008470ca745f0e937ce0343f07e0343f0700000000e32e147128623e07b5ce107106b033b85ce58f00176f1171f4e58f0070c8cb74eb99cc08feffffff8470ca740a8e1371e0343f07f08d1371bce58f00a7ce107101000000504b1171 (UID: 00000000-00006644)2d:T1ae8,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006644)2e:T5b40,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006644)2f:T88aa,Found reference to API (Indicator: "CompareString"; File: "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00006644.00000001.220629.00432000.00000002.mdmp, 00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00006644.00000001.220629.00432000.00000002.mdmp, 00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00006644.00000001.220629.00432000.00000002.mdmp, 00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00006644.00000001.220629.00432000.00000002.mdmp, 00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPath"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006644.00000001.220629.711E5000.00000002.mdmp")30:T188f,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "KERNEL32" at base 73fc0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d60000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "ADVAPI32.DLL" at base 73dd0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 725c0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "SHLWAPI.DLL" at base 74610000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74c50000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "VERSION.DLL" at base 73800000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71e10000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "USER32.DLL" at base 74120000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "MSCOREE.DLL" at base 71030000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74a00000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "PSAPI.DLL" at base 73af0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "RPCRT4.DLL" at base 74840000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "KERNEL32.DLL" at base 73fc0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fc20000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "OLE32.DLL" at base 76f00000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73580000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74a00000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74660000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71cb0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71250000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f400000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "WLDP.DLL" at base 71230000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "AMSI.DLL" at base 71220000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73800000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 711d0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSWOW64\2775GVNZ.DLL" at base 71190000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 710f0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 73fc0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "USERENV.DLL" at base 711f0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 73dd0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6f2d0000 "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 73fc000031:T4c1,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"32:Ta2e,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006644-00000C2D-1212937146] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006644-00000C2A-2445208821] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006644-00000C2A-2445318774] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006644-00000C2A-2445371876] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006644-00000C2A-2445512965] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006644-00000C2A-2445540249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006644-00000C2A-2445595065] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006644-00000C2A-2445671113] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006644-00000C2A-2445711278] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006644-00000C2A-2445775429] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006644-00000C2A-2445866688] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006644-00000C2A-2446104542] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006644-00000C2A-2446471943] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006644-00000C2A-2446589142] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006644-00000C2A-2447092649] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006644-00000C2A-2447239643] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006644-00000C2A-2447265274] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00006644-00000C2A-2447310630]33:T7ae,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")34:Te67,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "88FC0EE9287443DA3F60088A825600B81FD8548CD4A2DDA386E9D3B0EAAB2522.EXE"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")35:T42f,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\windows\microsoft.net\assembly\gac_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" reads file "c:\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe"36:T49c,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"37:Tdf4,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\FLTLIB.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"38:Td18,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\88FC0EE9287443DA3F60088A825600B81FD8548CD4A2DDA386E9D3B0EAAB2522.EXE.CONFIG" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\88FC0EE9287443DA3F60088A825600B81FD8548CD4A2DDA386E9D3B0EAAB2522.EXE.LOG" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe.config" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NW9ZFWY" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\88FC0EE9287443DA3F60088A825600B81FD8548CD4A2DDA386E9D3B0EAAB2522.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.V9921E851#"39:Ta4b,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00006644.00000001.220629.04C00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006644.00000001.220629.711D1000.00000020.mdmp")3a:Teac,"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006644) "88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006644)3b:Tb25,Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006644.00000000.220399.04C10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006644.00000000.220399.04C10000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp")3c:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp")3d:T9ea,Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006644.00000001.220629.711D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006644.00000001.220629.711D1000.00000020.mdmp")3e:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006644.00000001.220629.71181000.00000002.mdmp")3f:T6dc,Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 2039e2b2a542b216d3e2fa979c47340e-6000093-Mew0o3Hy9Arrs~9cjXgR8ye4w Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 2039e2b2a542b216d3e2fa979c47340e-6000098-Mew0o3Hy9Arrs~Xty17Ei System.Windows.Forms.Control::set_TabIndex(System.Int32) at 2039e2b2a542b216d3e2fa979c47340e-60000f3-Sq2daqE4~ax7A3sYiq System.Windows.Forms.Control::set_TabIndex(System.Int32) at 2039e2b2a542b216d3e2fa979c47340e-6000172-cx4KY2n_0es~Ab2p1Y Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 2039e2b2a542b216d3e2fa979c47340e-60001e6-cx4KY2n_0es~4opPf System.Windows.Forms.Control::set_TabIndex(System.Int32) at 2039e2b2a542b216d3e2fa979c47340e-60001ed-6Dgpnz4~aPj5B7qz9fXm Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 2039e2b2a542b216d3e2fa979c47340e-6000222-6Dgpnz4~fNp1Jx3 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 2039e2b2a542b216d3e2fa979c47340e-6000231-6Dgpnz4~Jgy7iC6je System.Windows.Forms.Control::set_TabIndex(System.Int32) at 2039e2b2a542b216d3e2fa979c47340e-6000292-8owDnyY2~Zo2we System.Windows.Forms.Control::set_TabIndex(System.Int32) at 2039e2b2a542b216d3e2fa979c47340e-6000431-rGs8zm~Pc2c7A40:T18072,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL2J!P @ `@KP H.text `.rsrcP@@.reloc@BpHd-0+(Q!CI 8Ei(8d ( 8rps z*( s ( ~{:& 8~ = ~{:\& 8Q =x ~{:/& 8$6+(u;(*B+(3l~*6+(F ^~*0N+(\0(8( ~{9& 8 8E8*B+(>U~*6+(r%B~*0P+( b(8( ~{9& 8 8E8*B+(e~*6+(vZm~*0+(iY 8E.Bk8)s ~{:& 8s 8s ~{9& 8xs ~{:Z& 8O( 8@*0+(ZH 8E48/*~o ~{+:& 88 ~{:& 80+(B.^; 8E,8*8 ~{:& 8~o ~{-:& 80+(/f 8E)U88K ~{9& 8~o ~{:& 8*0+(bV 8E)U88K ~{:& 8~o ~{:& 8*B+(7M~*6+(֐TT~*0H +(BU 8ET.8*9 ~{9& 8 ~{9& 8 w bY n;a~{a(z(! o* s+ ~{:@& 858V 8&~ ~{: & 8~(, ~{.9& 80}+(:sl 8EP)8K8F ~{:& 8~ ~{9& 8*0R+(v3 8E+8& ~{:& 8*0+([}\ 8E-QT8(t ~{#:& 88 ~{(:& 8*( ~ c +)Na~{a(z~ o- ( 8MB+(;_d~*6+(J~*0+(dNm 8E8\8s&(. t ~{:& 8( ~{:& 8*0N+(~N(8(/ ~{9& 8 8E8*0}+(yhH 8E,8*8 ~{9& 8~ ~{:& 8B+(,U~*6+(vY~*0}+(L e 8E,P8'(' ~{:& 88 ~{:& 8*B+(Qh~*6+(ZI~*0 8EYJ8(A 8*0 sH ~{:& 8( 8s1 ~{:n& 8c0G(8($ ~{9& 8 8E8*0 8E[E8V s2 8o3 ~{*:& 8(0 88 ~{:s& 8h*0X 8E8*~4 ~4 (1& ~{:& 80x 8E)R88H ~{9& 8(5 ~{9& 8*0v 8E,)88 ~{:& 8*(6 ~{)9& 801 XA8AEPBK G W YIk / p B Cqm V_Y us/^H>/O4 e{X C0@ K|tg H 3u n]k7g z8(:(2 8 ըu QY Ia~{a(zB e8|/ ~{:d& (8Y8- ~{ 9@& (85(:(2 85 A8; ~{9& 8 +2 33a~{a(z ?8(:*(2+ ~{9& -88 &88 ~{:k& 8`(:6(27 gA8@? n86 >V= b a~{a(z )A8# ,8+ 5A88_ ~{:& 87 =8 ~ c Ywa~{a(z( 28 u2 w)ya~{a(z, 6~{9R& 8G(:(2 ~{(:%& 8 S8 (:(2 ~{:& 8 @7 c ra~{a(z* .8(:.(2/ 8 8,H X da~{a(z. ~{9_& 8T y B5Y ]a~{a(z0 DA8 T~{: & Q8 lA8 Ö a~{a(z d~{9& Y8 ըu QY $a~{a(z(6 ~{:s& 8h8 2~{9O& J8D) H868 8'*8 88 ~{9& 48(:(2 08D 88F 8(7 W8% ~{!9& 8(:(2 m~{9e& u8Z m8L:P p~{91& $8&8 #A8 Wa~{a(z$ ~{9& 8 GXf ma~{a(z ;~{$:& A8%(7 (2 P8~ s ڳa~{a(z $A8N! ~{-::& V8/ ) ٦a~{a(z8 ~{9& O8 q~M 4Y )a~{a(z <8(:2(23 G8' i~{:& 8(:0(21 F8q8 \8b8 8S(:@(2D x8; %~{):#& M8 :~{:& 8 8 s)pk ira~{a(z ~{:& 8 gn a~{a(z ~{:y& 8n(:&(2' |8V ( 1a~{a(z6 8. ;O[ #Ja t& 838 >A88 cA8 8 ~{9& 8(:((2) ~{9& 3887 ~{:& R8 T~f NsLa~{a(z: j8o8Y 68`8 Y~{:G& 68<(: (2! o8$(:>(2? E~{:& s8 Z a~{a(z `8= '~{9& 8(:B(2C ~~{:& $8 ~{:g& 8\(:,(2- b8D3 qA8.(:(2 t8(::(2; 8(:(2 88e 8 K8 ~{:& 8 Nv I~Y a~{a(z2 }8|- v8n %~{9V& "8K(:(2 ~{9)& 8(:$(2% ~{:& 8(:(2 CA8(:8(29 @~{:& 8 O,-e iZa~{a(z< 88 h8p u2 :ca~{a(z4 ~{:>& 83 8%8 8 q~M 4Y La~{a(z@ f88c _88T 88E r886 !8(:(2 wA8(:4(25 8x1 78j(:"(2# 88R8 +~{"99& 8.(: (2 ~{:& 89 8C k~{9& .8YE __GqUZP 4j1 Z8= }YK9 2{a~{'a(z A8 Q~{:& 88i B~{9& +8 ~{9& 88" /8(:(2 ^8 z~{:g& ?8\8 ]8M $a oa~{a(z "A88 y~{:& &8 N88d 8(:<(2= 18 . Nda fa~{a(z& 988 a8 8w 8i B:a .a~{a(z> ~{:1& ;8& L88 ~{9& [88o A80l 8EAo V=i.8<* 3% *Y ka~{a(zs8 zs9 8v9 8](: o; & 8H= 85 8 o3 88 ~{,9& 89 8(< 8o= (> 88 ~{9& 88 8zo? ] ~{9Y& 8N ~{:4& 8)o? 8 : a~{a(zs8 z a 9ia~{a(zrpo@ ~{:& 80A 8ER6zD' .j8 ~{:& 88 8 8s ~{:X& 8M:e 84 8+8R ~{:& 89N ~{:& 8 8 ~{:& 885 ~{:& 88x ~{:p& 8e(8 ~{9H& 8= % Ö |Ҳa~{a(z 8*i 88 ~{&:& 80 8E/v,>8*} ~{:& 8*8 8(A QsB (+ ~{9|& 8qsP ~{:U& 8J0 8EiC8(D (0 8(E ~{:& 89! ~{:& 8*0{ 8EU18P~(; ~{:& 88 ~{ 9& 8*0x 8E.R8)(< ~{9& 88 ~{:& 8*0 8E -Q 8(*(F o c A?8a~{a(zoG (F (H +2 da~{a(z(I ~{:Y& 8N8| ~{:5& 8*: 88B ~{$:& 8oJ ~{:& 8 ~{9& 88 ~{:& 8(= ~{:j& 8_0 8E-_\LiL9bgC)D{()^ 088U 83~ #8 "~{,:& '8 8 E 8 ,88 88 ~{-:& 8 8x $~{:a& 8V )~{:;& 809 8 ~{:& 88 8(> A^ c ʳa~{a(z~~(? ~{:& 88 ~{:z& 8o~ ~{:P& *8E ~{:)& (8(@ 89 ~{):& 8* !~{!:& +88 ~{:& 8~ %88a ~{9k& 8`8s !~{:G& 8<8K ~{9"& 88 88 ~{:& 8 ]W ?ma~{a(z(K 8~ ~{:& 8EE ~{9d& 8Y~ 8H8[ 898L 8* ~{$:& "8(@ &~{:& 8i ~{ 9& 8~ ~{9& 88 89> 8p8 8a8a ~{:H& 8=: 8, :t 80 8Ed@8_(! oL oM (D ~{9& 88 ~{+:& 8*0 8EA;[4y}Ok6q)J`Z^2| &!q7-TWjng?868 ~{:& "8 ~{:& 89 ?88 ~{9~& 8soO 8\8 9~{9C& 888 ~{9& 8(< :N %~{9& <8:z !~{9& 8: ~{:& '8 :2 388 ~{:s& 8h 赂 a~{a(z(N 88: ~{:& 8oO ~{:& 8: 8: $88 ~{9& %88 888 ML b Aa~{a(z(P 8K8j 8<(D .8) ~{9 & 88 @88 8 688 888 8oK )88y 8w 5~{9_& 8T [ oJa~{a(z(N ~{9& 8(< 8J8D /~{:& 8=T 8i ~{:& 88 888 @ ~{:^& :8SoQ &838 ~{9& 8: 8 m ra~{a(z(P 18: 78 +8(R oS 9 >~{:& 68 08q 8d ZlLP Zga ]a~{a(zoT 8/ ; ~{:& 8*9 48oQ (8(U 8i ~{9& 88 28(5 8{ 8k8 ~{:R& ;8G8 -80:h ~{:& 8 o= o? o= (N 8 ~{:& ,8 8 *8 =8 #8 *0} 8E681*V sL ~{9& 88 ~{9& 80| 8E58*(C(D ~{9& 88 ~{:& 80r 8E+8* ~{:& 88 ~{:& 80 8E14kG8, s2 ~{:& 8*o3 88 ~{9& 8|(E& ~{9a& 8V0 8E(T9x8~4 8~4 8 8(1 88A ~{:n& 8c ~{:L& 8A* s2 ~{:& 8&~*~*0N+(=3(8($ ~{9& 8 8E8*0 +(k0 8E ].98~Fo 8~Fo4 88 ~{*:}& 8r9 ~{:W& 8L~Fo4 87: 8&~Fo ~{:& 88 ~{9& 8*~Fo3(V ~{:& 8~Fo4 80j!+(*[ 8E=a%4W,F888 8 88 8(j 8q9 8`~Fo~Fo(h ~{:/& 8$ ~{: & 8*8 ~{:& 8 ~{ 9& 8:' ~{9& 8:$ 8z8 ~{"9a& 8V ~{:>& 8380 ~{$:& 88 ~{:& 8~Fo~Fo(h ~{9& 804+(_*e 8E`s1/8[8X 8~Fo/88*~Fo9 ~{9& 8(] 8l~=oX oY oZ o[ o\ o" ~Fo1(X ~{9#& 8: ~{9& 8 80"+(T 8ERUxo)Cmg88 ~{:& 8i ~{:x& 8m~Fo0 8X : 8G ~{9 & 8!o] ~{9& 8E\8'8o] o^ (I 8: 88o ~{:& 8(Z ~{9l& 8a9! ~{.9F& 8;ݥ(_ ~{:& 8E*8(` ~{9& 8A 8(a 8893 ~{&:& 8| 8j(Y 8N*([ 8?(b (c 8* 8(d 9 8 8Ad0}#+($8 8E),8$8 ~{9& 8*(A ~{:& 80S+(qm> 8E8*oe ~{9& 80$+(Mi 8E[0F 8V(D (f & ~{:& 8(0 ~{:{& 8p % I u0ua~{a(z 8@(F *f a~{a(z(N ~{:& 8~Fo'sg oh 89 8* 8 % lu c xa~{a(z% ' P7a~{a(z% bbe 1a~{a(z%% }YK9 ia~{a(z% ~5f ba~{a(z% A^ c a~{a(z 8 % O _+0a~{a(z%% k hja~{a(z 8 r^ c pTya~{a(z X^ a~{a(z%(i %(i %(i %(i %(i (j (m 8 % j b a~{a(z%% `Pe Ua~{ a(z%% `Pe HQa~{#a(z% 7e *a~{a(z ~{9]& 8R0%+(ueT 8E,-8'(k & ~{"9& 8*sl % C. l]a~{a(zom %on %oo %op %oq ~{:d& 8Y0D&+(gfF 8E^3jmFD<'OQk8~Fo%9Y ~{9_& 8T:u 8C*88sr %ss ot %(u o= ov %ow (x ow (y sz o{ ~{:& 8~Fo7 88 ~{:& 8o| l#@[(} o~ l#@[(} sz o{ 888- 8)8 8~Fo+8W8C ~{:& 886 8( 8( ~{9& 8 8(u o 8s9 ~{:V& 8Ko o ~{$9(& 8~Fo~Fo` ~{.:& 8(^ ~{:& 8o o 8s 8 : 8 ~{-9k& 8`s % ss o %o ~{:'& 82ss ot 8o o ~{9& 8~Fo: 8~Fo+( 8~F~FoA m Gua~{a(z%~F% o?% Z%%o %%%%%%( 988 ( ( o@( ( o< 80z'+(|3 8ElE~p8g~F~Fo= re 5URa~{a(z( %( ( oB ~{:h& 8]~Fo= 8D~F~FoA U11 xjY .La~{a(z( %( Fv Y 7a~{a(z( o" o@ ~{,:& 8("(%x( (_ 8o*tP ~{#:N& 8C9 82~F(` & ]] a {a~{a(z%%%%( :8( (! ( t ( o> 80H(+(Ke]/ 8E7+lLFz p:c&8: 8~ :T 8m9s ~{:R& 8G8 ~{:.& 8# ~{ :& 8i88 8:R 88 ~{:& 88 ~{:& 8] 8sa 8\8 8M ~{92& 8' ~{9& 8( ~{:& 8 8i 8*8 ~{9& 8 8 ~{9s& 8h8p 8Yi ~{"9;& 80 8: ~{:& 8 ~{:& 80})+(\ 8E)P88F ~{:& 8( ~{:& 8*B+(Jb8~*6+(LX;~*0N+(n,[(8($ ~{:& 8 8E8*0]*+(A. 8E8: ~{9& 8E8QAp'Em`[83 ~{:& 8 9 8 8r 8Xo 8:848 888 ~{9& 8(i ~{9& 89 ~{:& 8: ~{:& 8(l ~{9& 8v8 8f8N 8W 8Jo o" o 8 : 8 8ݲ9\ ~{9& 8E+8&o ~{9& 8 ~{98& 8-~ o ~{ : & 8 8*8 ~{9& 8 8A<,he0++(MZ 8EIk8D~ o o o" . qa EQ-a~{a(z > ,!X ea~{a(z( ~{9& 8E8ݬ:9 ~{:& 8E+O8&o ~{9& 88 ~{:& 8 ~{9& 8 ~{9& 8|~ o 8b*8 ~{9F& 8;80K,+(wa 8Edr8(7 : ka~{a(z(R c ޵Ԉa~{a(z( (H 8w 8i9 8X(d ~{:8& 8-*8 ~{9& 8(k ~{:& 88 80-+(,H 8 Eo)IL8j8? ~{:& 8 ~{9& 8* ~{:& 8x ML b a~{a(zs ( ( ( ~{:& 8E 8 # c &a~{a(z%%%%( ~{:& 8Eyb8t '8Ć W6a~{a(z%( 8ET8 je A~a~{a(z( & ~{9& 8 o c Aa~{a(z%( ~{9Q& 8F( ( & ~{9& 8E8 ~{9& 8}9_ 8b( (! ( t ~{-93& 8(( 88 ~{:& 88 ~{9& 8_ ( ( & ~{.9& 8E8 ~{9& 8 8Q(_ ~{9& 8E*8(` ~{:& 8 ~{:w& 8lAL@@*d0.+(c~7 8E3){R: -8. ~{9& 8 ~{:x& 8m 赂 ʦ:a~{'a(z 8< ~5f j;a~{a(z 8 6% :ia~{a(z ~{9& 8~Fo'sg oh ~{:& 8 8(F Naa~{a(z(N ~{9O& 8D I Oa~{a(z 3% *Y ߫a~{a(z d? ;a~{a(z(i ( (m 8 Aa~{a(z ~ sa~{a(z(H 8 >a~{a(z s a~{'a(z(H 83 ~{:& 8 y b cea~{a(z ~{:& 8 s)pk g`a~{a(z ~{9& 8*0T+(7LLE 8E,8'(n ~{:& 8*0+([M 8E`8[sl %om %on %oq %op %oo %o (k & ~{:& 8*B+(noO~*6+(.ObM~*0N+(Df(8($ ~{:& 8 8E8*0+(%m 8E 6yR881~Fo9 8~Fo/88*~F(3o6 8(y ~{9i& 8^~=oX oY oZ o[ o\ o" ~Fo(s ~{:& 8 : ~{:& 8~Fo~ ;. 88> ~{9& 8 ~{:& 80/+(kC= 8EZX8U~Fo5 2Ye Ja~{a(z(N (2 ~{:& 8*(o o ~{9& 8EE8(b (c 8(t& ~{:& 8j(_ ~{:& 8E*8(` ~{9& 8 ~{:& 8~d00+(iW 8E) 8$8 ~{.:& 8*s (u ~{:& 80t1+(4#l 8Ee})h?8`8[ ~{:& 8o 89v ~{9q& 8f*9 8J 89 8.8 8 8 ~{:& 8 It `a~{a(zs zo 8s 8B+(a@~*6+(C~m~*0N+(הo;(8($ ~{:& 8 8E8*0N+(6 8E,f*8'(W ~{:& 8*~Fo' ( o ~{:& 8~F~Fo)~=oX oY oZ o[ o\ o" (5o8 ~{$9-& 8"~Fo-~F{o~Fo%~Fo7~Fo/(z ~{ :& 802+(7[ 8E*@?'16@fNh88 8w= 8d8 8Uo(o ~{9.& 8# tBV (Y a~{a(z( o ( o ~{:& 8 ~{:& 8 u2 ŠgVa~{a(z( o (u o 8Z8 8K ~{90& 8%: ~{: & 8s 8 ~{9& 8o 8 f |a~{a(z( o (u o 8q* ~{:W& 8L8 8= >V= b Sma~{a(z( o t o 89 8 8({ 8s ~{9& 8: 88 ~{9l& 8ao 8K k a~{a(z( o ( o ~{:& 8 & ]] a /Ua~{a(z( o ( o ~{:& 8 )a~{#a(z( o ( o 8O03+( 6I 8EZo AY~V1zK38Uo o8s8m ~{:u& 8jo 8U8 ~{:<& 81o oo oo oo oo oo o(| 88} ~{:& 8 88 ~{:& 8zo o8%88 ~{:G& 8<8 8-8 8= ~{:& 88C ~{:& 88 ~{:& 8: 8: ~{9& 8x: ~{:]& 8R*9 8A ~{9*& 8 80$4+(|hN 8EG!jlD]AZmK}8:q 8(d ~{:e& 8Zs ~{99& 8.8 8(] ~{&9& 88 ~{(:& 8(D (f & ~{ :& 8 88 8y: ~{9b& 8W(} ~{:<& 818 8 ( o 8: ~{:& 8 8(D (0 8: ~{%:& 88X 8z: ~{9_& 8T 8A*8 8/io ~{:& 8 E8ݗ:L 8E)O8$8F ~{9& 8o ~{:& 8 ~{9[& 8P(B~ (I :8- A^ c h a~{a(z(H 8(2 8C.|0S+(I70j 8E8*(t& ~{:& 8B+(EOH~*6+({0K~*0+(hOY(8($ ~{:& 8 8E >{M8~(o 88 * ~{:& 88 8~(o 9 ~{:c& 8X:V 8G*( ~{9*& 88 ~{:& 88 ~{:& 8( ~{:& 8 ~{9& 80Y+(h&f 8E8* @( ~{:& 80_5+(E?2 8E)*O;8$8 ~{:& 8 8s 8s ~{:& 8E8s s( ~{:& 8E.8)o ~{:& 8ݗ:H 8EO)8J8F ~{:& 8o ~{9& 8 ~{9& 8݃9\ ~{:& 8E+8o ~{:& 8 ~{:& 8*A4|~.*6+(\~.*0N+(ER5A(8($ ~{9& 8 8E8*0+(> 8EV|4DF8Q~Fo9 ~{9& 8( 8*( 89 ~{:n& 8c8 ~{:J& 8?( o 8*09+(K-P 8EO7+bH8Jo ~{:& 88~ ~{9& 8( 8i: ~{9R& 8G*8 ~{%9,& 8!s s %o ~{9& 8~/ ~{9& 88q ~{9& 8: 8~Fo 8e0:+(%Y 8 Em8=>8=0 8 ~{:& 8* '( o ~{9y& 8n ~{:Y& 8N 8@~Fo; 8EqG5#!8l8 8 8: ~{.9& 8x~Fo< ~{,9Y& 8N9 ~{:3& 8( 8(] 8o 8i ~{9& 88 8 88 8 8(A ~29 ~28~1s %2(+~3:8 ~38~1sB %3(+(+ 8 ݉(_ ~{:& 8E*8%(` ~{:& 8% ~{):& 880 ~{:& 8Ad0;+(hiU 8ECE)8>8: ~{":& 8~Fo 8*s s %o ~{:n& 8co ~{9H& 8=9 8,0<+(I[W 8EU4{T8 '( o ~{:& 8 ~{9& 8> ~{:o& 8d ~{9L& 8A*~Fo1(U& ~{:& 8E8(_ ~{:& 8E*8(` ~{9& 8ݺ 8 8yG!d0=+(s@c 8E&CRyi8!8 8(I ~{#:& 8 : ~{:e& 8Z~Fo% 8D~Fo# 8. {e K&a~{a(z(N ~{:& 8 ~{9& 8( 8*8 8(d 8E Ian28Ds ~{9& 8s 88 ~{9t& 8i~=(& ~{-:H& 8=: ~{9"& 8io ~{:& 8 E8h:9 ~{:& 8E:8o 88 ~{:& 8 8O8x ~{96& 8+io ~{:& 8E8o9\ ~{"9& 8E+8&o ~{:& 8 8vݪ(_ ~{9& 8E*8(` ~{:& 8F ~{:|& 8q( ~{:U& 8J( ~{9.& 8# 9n 8ALExkEe}%d0>+( = 8E(8#* ~{:& 8( o 8E~LBP8o & 8( :O ~{*:& 8 8(F o & ~{,:\& 8Q88 %% 8)~Fo5~Fo!(2 8 e 8a~{a(zo & ~{':& 8 ƘX 8a~{a(z(N o3 ( 8s9 ~{:h& 8]( o ~{9=& 82(_ ~{9& 8E78(` 8 ~{9& 8y ~{9O& 8DASAu0?+(8 8EWWl 9G)Y9+8R9 ~{ :{& 8p( 8P/ 8D*s s %o ~{:& 8o 8s9 ~{&:& 88] ~{9& 89 89 88 8{ ( o 8b(+o ( 8D~/ ~{:%& 8(+o & ~{:& 8(+o & ~{9& 8o 8o ~{#9& 8 ( o 8^ Ęs ,=3a~{a(z(N (& 8/ ( o ~{9& 8 KBH c C a~{a(zo & ~{:& 8%%%o3 % ~{:}& 8r w bY 4^a~{a(z(N ( 880@+(*2Z 8E)V88L ~{9& 8s ( ~{#9& 8*0A+(1|h 8E d(s=7a8 xO oVa~{a(zs zo 8 ~{:q& 8f* 8T:X 8C9 ~{9(& 8o 8s 8 8 ~{ :& 88[ ~{ :& 884 88% ~{:w& 8l0yB+(=s9 8EH.!8Cs ~{!9& 8{7{7` ~{-9& 8E\<8'^8 ~{ :& 8 8 ~{:p& 8e9 ~{9J& 8? '( o 8%8 8 8 : ~{:& 8>t ~{:& 8 8݈ ~{9& 8d ~{:r& 8g(A ~4:8 ~48~1s %4(+{89{88sB %}8(+(+ 8ݻ(_ 8EL(8G ~{9& 8(` ~{:& 8F ~{':& 8}7 ~{9& 8*A]^u0C+(9qe 8ELg*i8W8G 8 ~{:& 8s 8w 8l=b 8Z{: ~{9& 8 Eev%8`( 8 8j/ a _a~{a(z(N ( ~{:& 8~9 8m/ 8T(A ~5:8 ~58~1s %5(+{;9{;8sB %};(+(+o ~{9& 8(_ ~{":& 8E*8%(` ~{:& 8z ~{:g& 8\(u ~{9=& 82t 8 ( }: 8* '( o 88k ~{9& 8t ~{:& 8(u 8Az:dB+(-xl~0*6+(pS~0*0N+("Kc(8($ ~{9& 8 8E8*0 D+(Md 8E 8*s % ss o %ddsz o %o 8E6^BRi,qZ;y./F 4b*?#+>3yl8! 8o o 8> 8o (F (N o 8 28 4~{:& 8o &~{:g& 8\s ~{:A& 86o o 89s ~{:& 8 oX o & 8o o (8i ~{:& 8s ~{9& 8u ~{:]& 8R ~{::& 8/s )8 ~{9& 8 o| l#@[(} o~ l#@[(} sz o{ 8 9 8s +~{9& 8y(A ,8h 8[ ~{:@& $85o o 8> "~{ 9& 88 ~{9& 8 ~{9& 8o ~{:& #8o| l#@[(} o~ l#@[ lX(} sz o{ 189s %o o %o o %o o ~{9& 88i $~{9& 38o| l#@[(} o~ l#@[lX(} sz o{ ~{:j& 08_ o o o 8@ o o & ~{:& 8 ~{:& 8 -8o o ~{9& 8EUf*~8!! ~{:& 8uO ~{9& 8: 8uo tS 8]8 8Fo 849 ~{9& 8ݒua:] ~{ :& 8E)T88K ~{:& 8uao ~{9& 8 .88N *8 ! 8 /8o| l#@[(} o~ l#@[lX(} sz o{ 588 8o ~{9n& 8co (F (N o %879 8&! ~{:& !8 8 ( ~{:& 8sr 8 ~{9& 8 oW o 8s > '8d%(_ ~{:& 8EBq8(` 8o ( & ~{:& 8o ( & ~{$:& 8za ~{97& 8, ~{:& 8A4(2 0(E+(3[3 8Exv8so ~{9& 8EB-Q8=( ~{:& 8: 88T 8oX o oY oZ o[ o o ~{:U& 8J( ~{9+& 8 ao ~{9& 8E8 ~{9|& 8q*= ~{:U& 8Js % A 4a~{a(z(+o % 4$< #ha~{a(z(+o % "j e7a~{a(z(+o % `M b va~{a(z(+o % c v>a~{ a(z(+o % ۴ߠ b Vga~{a(z(+o % V Ba~{a(z(+o % ^ 7a~{a(z(+o % y B5Y =#a~{a(z(+o % o c /yda~{a(z(+o % ) a~{a(z(+o % Qf wOQ-a~{a(z(+o % A^ c )Ua~{a(z(+o % ;O[ #Ja Pa~{a(z(+o % Ηa~{a(z(+o % r^ c 4 ea~{a(z(+o % `M b N;!a~{a(z(+o % !ޕ& T sX 8a~{a(z(+o % }YK9 ;N_a~{a(z(+o % % lY ia~{a(z(+o % Gʔ Ga~{a(z(+o % o R+a Ca~{a(z(+o % }YK9 ua~{a(z(+o % gn a~{a(z(+o % X^ 3RLa~{a(z(+o % N̝a~{a(z(+o % }YK9 *6+(mC~>*0N+(5\(8($ ~{:& 8 8E8*0F+([1 8E'%8" ~{:& 8*( 8EvP)8q(((( 8s ~{9& 8( ~{:& 8uW%(_ ~{9& 8EX)8(` ~{:& 8o ( & ~{9& 8ݾ ~{:t& 8iRB+(^Dc~?*6+(VG>~?*0G(8($ ~{:& 8 8E8*0n 8EN8IoX oY oZ o[ o\ (u (& ~{9& 8*0 8E,8*8 ~{:& 8oX oY oZ o[ o\ (u (5 ( ~{:& 8t0G 8Ea=+89| ~{.:& 8 88u ~{:& 8~( ~{9b& 8W838'8" ~{:3& 8(*o 8&~@*~@*0N+(;]k(8($ ~{:& 8 8E8*0 H+(aG 8E2,V/8-s ~{:& 8*o 8EO@w8 8o (u ~{):& 88 8> ~{:o& 8do ( ~{9?& 84( ( o 8 ~{:& 8(_ ~{*:& 8EvR8q Ö }a~{a(z( & ~{9& 8(` ~{9& 8y ~{:& 8 ~{:& 88 ~{:x& 8mAb/0I+($5 8E[)X88N ~{9& 8o ( ~{:& 8*s ( s ~{:]& 8Ro 8>o 8$s 80J+(vtZ 8E-P A$Fa5\4g%tj88 *82o o ~{9& !88 "~{9& 8(( o 88S 88C +~{:& 8 8|o o 8`o o 8D(( o ~{:& 8o o 8o 8o Wo $~{9& 88A )~{:& 88 ~{:p& 8e8 8U*o 4o ~{9.& 8#EbF\xD ~{9& 88K (~{:& 8o o ,8x8 8h ~{9M& 8B8 828 8"8 8( &~{9& 8>y %~{&9& 8o o ~{:& 8o o 8vo (o 8Z8 8J 8=8 #8-( ~{!:& 8o o 8o 88e 88U ~{ 9& 880 88 ~{:t& '8io 8V( 8C( 818 80~)+(HG 8E)Q88G ~{9& 8o ~{9& 8*0)+(5IO5 8E258-o . ~{9& 8*8 ~{:& 80~K+(P 8E08+*( ~{:& 88 ~{:& 80_+(-si 8E782o o o ~{:& 8*0^+(j^n 8E8*o o o ~{:& 80^+(%M 8E8*o o ~{9& 80L+(_f 8E$sj'>LOr+':8 ~{:c& 8X C. R!ia~{a(zl#@[(} (( ~{(:& 88t 8 8( ~{.:& 89 8i ~{:& 8|8 8m 8_ (( 8Es9 848n ~{:& 8( ~{:& 8 8s z( +ښo o o 8 : ~{ 9& 8> ~{:g& 8\o3 8Il#@[(} (o & 8 8,H X {ja~{a(zo & 8l#4@[(} ( 8* (F ( (o- t 8 ( ֍ ~{9g& 8\8m ~{9B& 87 ~{:& 8( 8( ~{9& 8 8s o ~{ :& 80lM+(G5 8E%>8 ~{:& 8( ~{ 9& 8E>@8- 8- ~{:& 8 lu c @a~{a(z( 0^ 'Da~{a(z( ( 80%:p& ~{9& 8%:& 88-<( ~{9& 88-( j 8݄(_ ~{:& 8E*8%(` ~{:& 8 ~{,9& 8*APd0MN+(ff 8EF.?n78~*o 88o 8= 8|co" % lY (+. a~{a(zrpo@ 88(o & 8o ~{:& 88 8 8( ~{:& 8: ~{:& 88 8u( ~{:X& 8M8o ~{ :4& 8)s ~{):& 8s ~{:& 8 80 +(dPD1 8E,8*8 ~{:& 8rp~C:8 ~C8~Bs! %C( +(+ ~{9m& 8b0O+(7M 8E z+L}$Q]8s9 8o & 8:p ~{:& 8v( ~{:X& 8M* ~{&:0& 8%o (# o 8(s$ ~{,:& 8s 88u ~{:& 8o ~{:& 8{ 8j8 8[0P+(}O 8E18*s+ ~{:& 88 ~{:& 80Q+(!X 8E368.(o- ~{:& 8*8 ~{9& 80R+(9t< 8EQ-8L( ~{9& 88a ~{&:& 8 c a~{a(z(% o& o 8T*0S+( F 8E]8co" ) a~{a(zrpo@ o ~{9& 88 ~{:u& 8j*( ~{9J& 8?0T+(cD 8E,8*8 ~{:& 8(' o( ~{:& 80U+(0.I 8EmM?bd#t) G8h8 8o8 8`8 ~{:G& 8<9& ~{:!& 8o ~{:& 8 ~{9& 8() o* ~{(9& 89 88 ~{:u& 8j* 8Zo+ (, ֍( 86( 8! 8o- ~{9& 8 8s 8~. o/ (0 88) 8 8s 8} ~{9b& 8Wo+ 8D (1 js2 i(3 8 ~{9& 8 ~{9& 8s4 8i 8 io5 ~{:& 8|i 8h0V+(}3L 8E,)88 ~{:& 8* o6 ~{9& 8B+(@w/~A*6+(pC~A*0N+([VI_(8($ ~{:& 8 8E8*0X+(SW 8E,)G8'8 ~{:& 8*s7 ~{:& 8E8o8 ~{:& 8E8&983o9 o: ~{:& 8s ~{9& 8E8 s; ~{:& 8E78io< ~{ 9& 8 E.U8o ~{'9& 8o= ~{:& 8ݗ:H 8EO)8J8F ~{:& 8o ~{:& 8 ~{:& 8݄9\ ~{:& 8E+8&o ~{:& 8 ~{9& 8 :H ~{9& 8E:881 8 o ~{:& 8 8o> 8o? 8o@ 8݄9\ ~{9& 8E+8o ~{9& 8 ~{:& 8%(_ ~{:& 8EL)8G(` ~{$:& 8 ~{:& 8 8(%y( ~{:& 8 ~{9& 8|A|;x^ye @`x%e_OB+(P.Z=~E*6+(YTM~E*0}+(ViA 8E)R8$( ~{9& 8sF ~{:& 8*0N+(x4(8($ ~{ :& 8 8E8*0Y+(+rY !8E- sk M/ow)p^ ze fv P 8 8' ~{:)& "8~F~=oX oY oZ o[ o\ ( o ( o( 8(F ~{:& 89 ~{:& 8~F~=oX oY oZ o[ o\ ( o ( o. ~{:=& 82~F~=oX oY oZ o[ o\ ( o (A o ~{9& 8~F~=oX oY oZ o[ o\ ( o (u o" 89 8~=oX oY oZ o[ o\ ( o (u ~ (I 86~F~=oX oY oZ o[ o\ ( o (u o ~{:& 8~F~=oX oY oZ o[ o\ ( o (A o &~{:& 8~F~=oX oY oZ o[ o\ ( o (u o ~{92& $8'~F~=oX oY oZ o[ o\ ( o (A o 8~F~=oX oY oZ o[ o\ ( o (A o ~{&9& 8~F~=oX oY oZ o[ o\ ( o ( o )8C~F~=oX oY oZ o[ o\ ( o (A o 8~F~=oX oY oZ o[ o\ ( o (A o& ~{9& 8~F~=oX oY oZ o[ o\ ( o (u o ,8U~F~=oX oY oZ o[ o\ ( o (A o ~{:& 8~F~=oX oY oZ o[ o\ ( o t o$ #~{:& 8~F~=oX oY oZ o[ o\ ( o (A o 8R*:| ~{:9& 8.~F}o 8~F~=oX oY oZ o[ o\ ( o (A o 8:A 88 8~Fo ~{*:& (8~F~=oX oY oZ o[ o\ ( o (u o ~{:4& 8)~F~=oX oY oZ o[ o\ ( o (u o *~{9& 8~F~=oX oY oZ o[ o\ ( o ( o 8~F~=oX oY oZ o[ o\ ( o (u o '~{9:& $8/~F~=oX oY oZ o[ o\ ( o (A o 8: 8~Fo ~{9& 88b 8~F~=oX oY oZ o[ o\ ( o (u o 8T~Fo 8=~F~=oX oY oZ o[ o\ ( o (u o ~{:& 8~F~=oX oY oZ o[ o\ ( o ( o* ~{:& 8~F~=oX oY oZ o[ o\ ( o t o, ~{97& 8,~F~=oX oY oZ o[ o\ ( o ( o ~{:& +8~F~=oX oY oZ o[ o\ ( o (u o 8~Fo ~{#:j& 8_~F~=oX oY oZ o[ o\ ( o (A o %8B+(xg~G*6+(LN~G*0+(be(8($ ~{:& 8 8E,TS8(< ~{:& 8(0 ~{:& 8*s }o 8N+(jsW{H8*0R+(zg 8E8*}H ~{9& 8N+((6vX{I8*0R+(6;= 8E8*}I ~{9& 8N+(d b{J8*0R+( )? 8E8*}J ~{.9& 8N+(2{K8*0R+(}+V 8E+8&}K ~{:& 8*N+(ݴ/<{L8*0R+(51n 8E+8&}L ~{:& 8*N+({P8*0R+(_86 8E8*}P ~{9& 8N+(L*`{Q8*0R+(p3 8E8*}Q ~{9& 8N+(I1{R8*0R+(-;= 8E8*}R ~{:& 8N+(zH{S8*0R+(6_ 8E+8&}S ~{9& 8*N+(x!`{T8*0R+(ӣk 8E8*}T ~{9& 8N+(L{U8*0R+(C/ 8E8*}U ~{9& 8N+(|}1{V8*0R+( \] 8E8*}V ~{9& 8N+(1{W8*0R+(hA 8E+8&}W ~{9& 8*N+(:/{X8*0R+(|Y 8E8*}X ~{*:& 8N+(*fH{Y8*0R+(3N 8E8*}Y ~{9& 8N+(K{Z8*0R+(y< 8E8*}Z ~{)9& 8N+(%$>{[8*0R+(Y 8E8*}[ ~{:& 8N+([kb{\8*0R+(S3 8E8*}\ ~{9& 8N+(`A*H{]8*0R+(`j< 8E+8&}] ~{9& 8*N+(&Me{^8*0R+(HuU 8E+8&}^ ~{)9& 8*N+(oB{_8*0R+(en^ 8E+8&}_ ~{":& 8*N+(7QI{`8*0R+(1Y 8E+8&}` ~{:& 8*N+(WM{a8*0R+(jM 8E8*}a ~{%9& 8N+(1\eM{b8*0R+(-0; 8E+8&}b ~{9& 8*N+(!A{c8*0R+(:8b 8E+8&}c ~{:& 8*N+(HN{d8*0R+(\;vj 8E+8&}d ~{:& 8*N+(K{e8*0R+(YKF 8E8*}e ~{:& 8N+(fH{f8*0R+(oa] 8E+8&}f ~{ 9& 8*N+(T6{g8*0R+( UQ 8E+8&}g ~{9& 8*N+(I-a{h8*0R+(tg 8E+8&}h ~{:& 8*N+(P1>\{i8*0R+(V 8E+8&}i ~{.:& 8*N+(l!8{j8*0R+(}e 8E+8&}j ~{:& 8*N+(6(O{k8*0R+(NT 8E+8&}k ~{:& 8*N+(S{l8*0W+(IR 8E08+( }l ~{9& 8*N+(C{m8*0W+(Fh 8E08+( }m ~{:& 8*N+(m7{n8*0W+(|'L 8E08+( }n ~{:& 8*B+(sh~p*6+(I=.~p*0N+(l[Ye(8($ ~{9& 8 8E8*0Z+(K 8E4Y8~Fo 8~Fo 8(G& ~{-9& 8(P ~{:g& 8\9 8K9 ~{:0& 8%(H& 8*0[+(aPd 8EwOtnB*Q!''K8r ~{:w& 8l* h j[a~{a(z 8B9W ~{:'& 8oW oB (I ~{9& 8 ~{:& 88p ~{:& 8 >V= b W a~{a(z 8l oC ( 8Q 8D oC ( 8!( ~{: & 8 4%w( s$ ~{:& 89O 8 8(A ~{9& 8~ 88(N ~{':S& 8Hi ~{:*& 88 ~{:& 86(! (D 8 88W 8 8: ~{ :& 8(b (c 8q 8\0\+(j 8Ef?8 89 ~{:& 8sK ~{:t& 8i(b (c ~{:K& 8@8Q 8) 6a~{a(z 8(A LsB (+ 8o (+( +s$ oF ~{ :& 8 E8 ~{9& 8E+?8&95 ~{9& 8(b (c 8ݗ:9 ~{9& 8E:+85o ~{:& 88 8 ~{9& 8h9\ ~{(9& 8E+8&o ~{ :& 8 ~{:& 8 * (G 8 '8Ć /a~{a(z}r ~{9& 8A4x7teB+(%|I~q*6+(qEh~q*0N+(Qc(8($ ~{9& 8 8E8*0F]+(: 8E;=aWp*8~Fo~Fo/`88:& 8~Fo9 8l~Fo1(U& ~{9H& 8=~F~Fo~F%o/(Ro0o2 ~{+:& 8~Fo/88(r 8~Fo~Fo~Fo ~Fo(Q 88 ~{$:m& 8b8 8S: ~{:8& 8-*8 8~Fo :N ~{:& 8 8 80V+([` 8E/8*(H & ~{9& 8*0^+(kdg 8E;u(86 ~{:& 88i 8~=oX oY oZ o[ o\ o" oI R 8j 8Z9 8I*~Fo(/~Fo~ (I :8/ ?a~{a(z~Fo(N 8~ $a ΣnGa~{a(z~Fo( ~{9& 8B+(8{L~t*6+(gYj~t*0N+(7:>(8($ ~{!:& 8 8E8*B+(K~u*6+(1Y[~u*0N+(I.Q(8($ ~{:& 8 8E8*B+(a~v*6+(>;~v*0+(0S; 8E) 8$8 ~{:& 8*( ( ~{9& 80~+({9 8E,8*8 ~{:& 8( ~{:& 80 +({-mK 8EU)8P8K ~{:& 8(! ~{%9& 8*0~ +(cVI@ 8E08+*(" ~{:& 88 ~{(9& 80-+(=je9(+ 8 8*B+(rg*0P+(K|7(8($ ~{:& 8 8E8*B+(:Fn~ *6+(*n~ *0B+(nl{% o& 9(+{% o' 8*0~+(l(8($ ~{:& 8 8E08+s( }% ~{9& 8*B+(*^a~) *6+(iS~) *0N+(0gl(8($ ~{:& 8 8E8*0+(i]] 8E`<8[oW {(I ~{:& 88 ~{:& 8*B+(D94~*6+( ]h~*0N+(R(8($ ~{:& 8 8E8*N+(x<{ 8*0R+(OhP 8E+8&} ~{ :& 8*N+(C} 5{!8*0R+(J\S 8E+8&}! ~{9& 8*N+(sH!d{"8*0R+(t L 8E+8&}" ~{:& 8*N+(8{;{#8*0R+(1]d 8E8*}# ~{:& 8N+(Ƕ8\{$8*0R+(шA6 8E8*}$ ~{:& 8N+( JP{%8*0R+({m 8E8*}% ~{:& 8N+(W;{&8*0R+(l+F 8E+8&}& ~{:& 8*B+(\4D~'*6+(Pqg~'*0N+(eQDV(8($ ~{:& 8 8E8*0}+(@ 8E)*8$( ~{:& 8*s1 ~{9& 80y@+([ 8E+(8& ~{9& 8*8 ~{-:& 80+(t 5 8E9]84o ~Fo; ~{:& 88 ~{:& 8*0y@+(prL 8E,8*8 ~{ :& 8 ~{:& 80y@+(y{mO 8E,8*8 ~{9& 8 ~{:& 8B+(gB~6*6+(IxU~6*0+(Z+H(8($ 8 8E*+8%9 ~{:& 8*{7}7 ~{":& 80+(Vz}i 8E5880o {7 ~{9& 8*8 ~{9& 8B+(yRn~9*6+(M_~9*0+(6\PG(8($ ~{9& 8 8E@8{:}: 89 ~{:& 8*0+((H-W 8E,)88 ~{!:& 8*o {: ~{:& 8B+(pbc~<*6+(%S~<*0N+('c23(8($ ~{:& 8 8E8*0}+(QH 8E)R8$( ~{:& 8sB ~{9& 8*0W+(k. 8EW)8R8M ~{:& 8 ](: ~{9& 8*B+(W~D*6+(s.[~D*0N+(He(8($ ~{9& 8 8E8*0+({99 8E) 8$8 ~{:& 8*oW {ro (+( +s$ o ~{9& 8|B+(h|Fm~s*6+(ܓ^N~s*0_+(<=e@ 8E*.W)8(J toK 8*~z XoL (^:& 8x~zoM XoN t (^9K& 8@ (_:*& 88! 88 8i~{*6+(rH~{*0W|.(! o* }@.%е( ~s$ s$ ((~4 ~4 sQ jj~4 sR ~4 (S &*EP*0 W`. iZ ]Y X ]: ij\nXjXm ijjZ (8Xi?i(%G `R8$ njY YZ?_d j_ҜY=iZ \ #Eg ܺ vT2 8 b89dXXbXXb`XXb`X`X=D (g (g (g (g(g (g (g (g (g (g (g (g (g (g (g (g(h (h (h (h(h (h (h (h (h (h (h (h (h (h (h (h!(i "(i #(i $(i%(i &(i '(i ((i )(i *(i +(i ,(i -(i .(i /(i 0(i1(j 2(j 3(j 4(j5(j 6(j 7(j 8(j9(j :(j ;(j <(j=(j >(j ?(j @(j X XXX X \D( (T (U (T (U (T (U (T (U *K_f_`XX~YX(kXT*K_f_`XX~YX(kXT*KaaXX~YX(kXT*Kf`aXX~YX(kXT*F Y_d_b`*n~~:(p~~*($ *0,ai] i[i(i[ >X8 ] Z ZXbXb`Xb`` Y@I>BX 8# >bi XY` X ?8.X XbXb`Xb``% ׿7 RI"r c( !4` YaY _ _ d b`a d b` o7%X Ca@ Y\XYXX daX baX daX bYaXvlmXY@P>Ia8->bX X__dҜX?8Ia _Ҝ X _dҜ X _dҜ X _dҜX?*0jb (l9sV 8Qs7 E&rprp(W oX t &rprp(W oX t *$C #E0.sY &&(Z &*'v(l:sY ([ *(f*088+iB8i o &(sYB*6o\ &*0Zc 8Jo] (ZXjXo^ o o o &o BXA XY*X ?*0d(! ~:d~ (_ s` .(! o* rpoa sb %o] jo^ %%o] oc io o 9i]i[i( >X8MZ Y@F>> 8%> b iXY` X?8+XbXb`Xb`` (wX Y@S>K a8.>bXX__dҜX?8M a _ҜX _dҜX _dҜX _dҜX?i[s s 8# o ood X? o 9(e (of 8oM ~og @_ ?_.(! oL oh "oi toj 9ok (J oK ool iX "!om on 9!om oo 8!(! $8!$X$op $X$$i?~ oq !sr ""os #%8t%E'88D#~t ou 8A#~v ou 80#~w ou 8#~x ou 8#~y %oz %X%% ?#~{ ou #: ~| 8~} o~ #~ ou "o oK &Xi?&*ALOh w.rp(? * **0/6e 28E}K-lN @*0,)h -#("*#.&j '&^%b, $BZ )e_&S.}"&D,/L"J'*& F#-,t{#' . "l>(+%e ': UT/Rf& x (".-F& %!z_#` W V!M#+*+A$Q.H(0+ )x|(q*U+5/! '=L(=')Cym[ G-X* Y*`( / -)$ $/km $rM u!VCo> E+B%+ ]|#/z %I\-$+-#- $s7\''3+k+! C@&m-!* ) L*K). T/./!)(. K af-)\t'`$q$e"L+uC$.% !V9,$*)(i|" c, ~u(-")&2Rd)W"zL+*G",/p$)% '!Nz8F 8 VX A8 T(:& t8 F Y &8 >X (:& 8y M /Y <8` aҜ (9@& 85 > BX 8 DY K8 ?(:& D8 %X 8 8 M8~ (9e& 8Z d(:=& 82 { TX '8* 8 -Y (:& 8 X |X 8 NY 8 `X a8f8 + 8[ (:>& 83 t -X Z8 a8 8 GY (:& 8 >Y $(:& 8 KY d(9p& L8e ^X t(9A& c86 CY (:& 8 4(9& 8 &8 -Y I(9& _8 ? uX l8 n mY 8l IY (9N& 8C , X (:%& 8( ((9& 8 i OX 8 HY 8 UY (9& F8 8 gX 8y 3Y (:U& .8J: 88 n lX 8 O8 U GY n(9& p8 Y 8 r X (9& 8 -Y n8m > X (:O& 8D 87 DY 8 +Y +(9& 8 6 Y 48 @ X Q8 p lX 8 3Y Y8u C /Y ](9Q& 8F 8. ,8 RX 8 $8 EY 8 (:& z8 +Y 8 , @X 8Z b YX 88E YX 8& EY i(:& 8 8 n xX 8 AY 8~}(( q8 d8j B8R 0(95& m8* M X /8 W .X P8 7Y ,8 BY 8 8 TY -8{ !(:j& 8_ $ DX S(:;& 80 4X <8 9Y 8 G8 ' #X (9& 8 (:& m8 8k 8O 83 $ YX 8 LY #8 (:& x8 (:& I8 (:& 8 b(:u& 8j 68R /Y U(:4& }8) FY (:& .8 .X 8 b8 n 2X 89e >8 f8 OY 8v + X (9R& -8G :Y A(:#& F8 X H8 ZX 8 U ]X 8 c8 8 | {X j8f KX (:B& 87 48 08 6(:& V8 wX s8 :X C(9& 8 (9x& 8m 8U (98& P8- ((9& 8 9Y (:& 8 R8 R `X 8 ((9& 8 MY 8d %Y 9(:@& 85 NY \(9& 8 X (:& f8 2Y (:& 8 G DX 3(:& (8 FY 8l A {X 8S X X ;8: 8 ( J8 ( (9& *8 i X m(9& 8 i X 8 d8~ 3Y M8e ](9H& 8= J8% @8 K X H8 i8 E8 =Y !8 ,Y 8 7 fX N(:t& 8i *8Q MY K88 >Y 8 #8 ,Y p(:& 8 8 < X 8 8 (:r& 8g (:O& 8D 5Y (9&& "8 1Y (9& G8 38 G $X p8 (:& 8 } )Y =8z =Y %(9V& 8K (:.& .8# @8 8 QY (9& _8 w88c (9& 8 . Y Z(:i& r8^ nX 8? v 'X 8& C X 8 M(:& T8 dY (:& 8 -Y O8 8 8g RY 8H (:+& 8 (:& 8 9 ,X 7(:& 8 g8 Y8 /8 6 X s8d 58L I X u8-~ o8 1Y k(:& 8 x dX <(:& 58 8 8s; %i(%(((( 8[P (:E& V8: e8 8 (9& ?8 bX 98 5 _X +8 :Y 8 X D8t &X (:P& :8E n TX 8, { +X u8 ;8 m ]X )8 Y q8 8 (9& P8 (:& 8 (:m& 8b 4(:E& _8: @ X {(9& k8 7Y 8 .Y -8 "(9& m8 (:& j8sm (n (:j& W8_(%( ( 8> ] PX {(9 & 8 f8 '8 & 83 X 8( (:& 8 3 tX o8 ?Y (9& e8 BY |8 NY M(:t& l8i { `X h8P BY ^81 (9& Q8 tX 8 Q hX i(9& 8 EY 8 8 !X h8 K 0X r8d H X 8K +(9.& \8# Z8 88 2Y [8 5Y 8 8 6Y 8 (:& 8 TY 8a o dX $(:=& 82 v8 CY :(:& W8 ! aX 8 8 RY 8 lX ?(9& 8x cX 18_ X 8F P #X 8' y `X 8@ `(:& 8 (9& 8 8 KY (:& H8z | >X F(9V& 8K X (9'& 8 8 X 8 8X R8 / 2X 8 ^ mX 8 - {X C(:& 8y # X 8Z X (:6& F8+ 9X 8 # &X 8 ; xX 8 6X w8 x8 $X e(:u& F8j _ oX z8Q 2Y =(:3& 8( (:& 8 I8 ;Y (:& 8 U8 ;Y ~8 0Y X8i X8Q N OX 8* (9& z8 U8 08 1Y 8 8Y g8 c X 8 v(:g& <8\ G QX )8C "(:+& 8 7(:& 8 E8 1Y 8 DY 8 :8 G (Y 68w /(9Z& 8O LY 286 `(:& 8 MX Q8 8 8 m JX 8 3 OX 8 P X [8j =Y (:F& 8; N X 8 oY (:& 8 4Y y8 QY (:& ]8 t8 8us%(j(%%((i(( 18? = #X (:!& t8 8 j X 8 ,Y 8 K $X t8 qX S8 8p 8Xi? 8C z8+ Y (9& 8 J sX 8 MY "(9& A8 X ^(:& T8 >X (:g& 8\ k X %8C BY 8* $ gX (9& -8 \X N(:& 8 2Y >8 X s(:& 8 @ _X (9`& G8U 8= e GX (:& j8 8 @Y y80f~:)s s ~}rpoa (y~K ( ** *:+(5P( *0E+(Hi(8($ :& 8 8E8*B+(_/H~ *6+(ajc>~ *0xm+(>5( o (%к( ( o (qs (o o8 o? % o s; %io o o ( *:+(E 55($ *j+(y~\($ sb }*N+(j5{o] *R+(o{0{o *Z+(K.{o *N+(\(k{o *N+(LpI1{o *0n+(K;g 8ED%th8 (:& 88I (:& 8( s ( 8{rps z*~9 8[( ( ? 8>:+(6_T($ *B+(l5~*6+( l~*0o+(^_r;(8sR }8(+ :& 8 8E8*o } :& 8E8& 9& 8E8ݖ 9y& 8n\:.0p+(IlV 8E3}dNP)|28s 8 :& 8*o 9z& 8o*sb 8[oc ԍ( 8BX :1& 8& ( 8E&Hdu58i?T :& 88 8 o 8X 9& 8w 8f :X& 8M~ o 85& 9& 8E8ݛ 8( 8 % lY Aa~{a(z 89P 88> 9& 8 io & :|& 8q?(! o* (F (N oa 8Co] jo^ 8+.0?q+(c-[ 8E-]Ux4h^sWD1p"48({ oa 8Y80 8N*o (:3& 8( 96 8 (:& 8 s 8{( : (9& 88| 8( 8{o 9< 8} :; 8l 9~ (:V& 8K~o & (9-& 8"{o 8oa (:& 88 (9& 8{ 8{( 9e (9& 88Y 8o{o u 8N( :> 8; 9 8*{ ( } 8{:l 8 (:& 8{ {o 8(_ 8E#Btc8 (9& 8 (9& 89p (9& 8xo 8g{o u (9E& 8:( :& 8"{o 8Y:S (:& 8E$E88; (:& 8(e (9& 8 8!( 8: (:& 8 8A\r|B+(Pq.~*6+(Y Na} a8~ 0O+ Y Da} ^8~ G) U\a |Da}* (:~& >8s~ e c d`a} 8N~ AA= Y ?Oa} 8)~ z tae xa} 8~ /X px a} 2(:& ?8~ * c b Fa} (:& '8~ \l b 9ęX xa} O8`~ Q.f Pa} F8D~ ; H3Na Z9a} 8*~ a4N3 cf s9a} J8~ Y,e IX b a} <8~ * 5a $a} *8~ اm qa ~Sa} q8~ z1Q b PDa} (9Y& 8N~ "e /fDa} (:)& 8~ p S|a c {_a}. o8~ :-i( b tZPa} .8~ uٔ WY z1a} 08s f8~ 9'f [1X O ca} (9j& P8_~ 0 $X Ua}" (:5& 8*~ :-i( b 8a} G8~ a4N3 cf s9a} ((9& #8~ Q.f ! ؟a} _8~ dކ b ֹC[a} 2(:& )8z~ WT: Z8tY L5a 5sMya} %8O~ pee ua} 58.~ Q.f 6a} T8~ b c La}+ D8~ p S|a c a} &8~ e b ׅa} (:& 8~ b c VDa} 78~ HPJfe IPJa} "8~ oa c a} Y8~ اm qa a}# M8\~ X ȣ#Paf Ԅa} (:1& 8&~ oa c ]0Aa}' R(9& d8~ e NDma ,a IKja} 48~ 0O+ Y Da} 8~ pe -a} V8{~ b 1yDa} l(:Q& !8F~ Y,e IX b Wa} p8~ HPJfe IPJa}, 8~ d% bf Q!a} 8~ 0O+ Y Da}) E(:& 38~ s,( a m$a} [8z~ `s c !ga} (:P& L8E~ /X pMp b ǹ|a} (:& 8~ Y,e IX b $a} @8~ s c ~0'a}( 18e~ c 2a} n8@~ ź̒ee a} =(9& 8~ f \gX v]a} k8~ ߼ -Y &fa} 38~ C b 1fa} A(:& b8~ G) U\a K_a} K8f~ :-i( b qV0a} Q8A~ cn b|a {a} $(:& 88~ + *X b 5Ra}- -8~ e c foa} A8~ b 1yDa}% W8~ :-i( b a} (9m& 8b~ f \gX v]a} 8<~ NIe sa} U8B+(.nM~/*6+((j6~/*BSJBv4.0.30319lxN#~NY#Strings#US #GUID#BlobW= L/q7f+ K+Z_f_l_t+_.Gb}+ } @__$___:J _ _ _ +_ _X_ t _2___1__ __-B_ITp~ Ik~____2] x_ 0_;_Oc __'.Z__c_ ; Yi_F~S~,9G]G___.A .C"]"i"|""" "# 5# B#Y#_a##_$~$~$$$_%_$%_I%_[%_n%_%_&&)&4&?&'''('?'(''(''('B(O(l(O(}(O((O((O((O()O(3344444666_9i"9i"9O(\9_9O(99:O(3:O(g:O(:::;:;.;:;:j3EC3QEH3E>3E/3FH3UFM3FRFFG@GcGGGGGH5HXH{HHHHI*IMIpIIIIIJBJeJJJJJK7KZK}KKWKK L LOLrLLLLL!MDMgMMMMMN9N\NNNNNO.OQOtOOOOP#PFPiPPPPPQ;Q^QQQQQ R0RSRvRRRRS%SHSkSSSSST=T`TTTTTU2UUUxUUUUV'VJVWP T!6 d!= x!Q !T7!y ! "T7d" x" "6 p#$3$=3 %G@%Q%eK;e0<q(>T7>>@>((>T7?$ ?8 % (' ' *(1( (4H)6 )T7)j**j*j8+L+\+6 ,T7l,(- -' .> T.xB;LEG#xpHII;JK6QVxR [ [&Y [? \Ik!\S4"t]]#^g$^{$T$F&F)F*T+F-F1F2?T74@74@U5@i5^T75^x5`6c8DdC8g:hO:xh;LlO=m>hr?t/ADxECxdCxxOCTCFTEFdLFkMxT7RPyyR|%V~=xY,XZ4 \̈_,bdԉ!dT7d@d0d>f0>ghďfhԏT7h0 h;vhdnmxypOwx,x@T7x AG x4AU xAkyA1_yBuzBz|B{B{B|C|dC}xC_}C~C~LD`D) hT7ĭq|@ > 8 O pDT7D6 XE!.E!xF.!.G=!.GL!G`!7GT@LH!H!H!FITOI!8J!LJ"UT7x;"N#O#,#>,_W,[$i,{,,_,[,l,,_,-_T!-[h5-I-b-< {-P - - -_$!-8!-_!.[!."9.[ "@."G.["Y."k.[#t.h#}.|#._#.[#.P$.[d$.$/$/_8%%/ L%7/ %I/[%V/ &c/4&v/&/&/'/ '/ |'/'/'0[(0d(50x(J0_(_0(q0L)0`)0_)0)0_4*0[H*0*0*0+00+0 +0+1 1 1 1 31| T7-3.3135 45!4KT7TL7MY4Mm45T706484840|:4:5>:T7:05;D5I ;T7|;l5;5T$Mv6BNT7O6 O7O7T dO6 <8(bI<)bT<=)Ș_<+<;,<>-<-=-t =o/ -=0 D=1^=3=6\=:ĝ=? =C|=F؞=G=A G=H=A H=A I= J= J, > JL> Jl > J+> J6> J̠A> JL> JW> J,b>oJ8v>;JH>AJT>FJd>OKp>OK|>oK>oK?K(?SK m@m nAqA7qTqsv{T|~TT"1T:ATNS^УBT7ȤBܤ%BpT6 BX!Cl5C|T76 ^VVV\D Cccccccc! !!!! !! !'ccccccccccccccccccccccccccccccccccccccc!6070727;7B7070727;7B7@@@ @@@@@@ @@@27;7@B727;7B7A$A+AA$A+A27;7B72AB7YeYT7YlIrIx+aT7a1_a>_aLa`asT7T;_ T&5BiM>y_VuyT7qT7qqy7y '?BPII 70IyHT_h!by!aI*)J117aT_+[9T__T7A0oA67IdZlT7luldlYTYy[y[T T7TY m yym y7 T_T | 7+7TT tT m$ a n 9 u ) 9TT Z 7` I s [+ q"_d!uT7T7T7"7T7"_"_"_"u"" #[u#.#""(l#(v##9 #[T7#(udT7ddu)$1$)Tm)$7T7)$u)$)% )% )*% )5% )>% )P% )b% )v%[)%)% T. )%> I%D )%I T7&s q& ` a an IT7J& !$ aaj&Yu& T aT_YTTI& &IT4I&&I&OK'{yS'X'!$b'*yMTim'iT. !T: 'T7( ( (%T/(7(<( (Ce)xI33334"ICI6{96666696QT7YT7a/9ii9 qT7!b:y:T7@:u:B:Q):ky:. ;T79%;)T: yuO6?;6S;[9`;yn;|;y;[;y;yA;yT;;;;<<<;k?m@mAoBok1$=4 vrcFi^D&$8=O=fwxxy÷-m߹ & K _ ` KzX:XXX #"(')'*'- /.0.102.3.4.5.6.7.8.9.:.;.<.=.A@B@C@D@E@F@G@H@I@J@K@L -0/|bO@GG 9# E LumenMindCompilationRelaxationsAttributeSystem.Runtime.CompilerServicesmscorlib.ctorVoidSystemInt32BooleanRuntimeCompatibilityAttributeDebuggableAttributeSystem.DiagnosticsDebuggingModesAssemblyTitleAttributeSystem.ReflectionStringAssemblyDescriptionAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeSystem.Runtime.InteropServicesGuidAttributeAssemblyFileVersionAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttribute84633d73-d986-47e1-85ca-472e3f281cdaLumenMind.dllMyApplicationLumenMind.MyApplicationBaseMicrosoft.VisualBasic.ApplicationServicesMicrosoft.VisualBasicFMmtwtUjTFVFL7E8PlML4YYoii8j3aFoBOV8ComputerMicrosoft.VisualBasic.DevicesT7EKGlXAoYquPWHXqblNJSXqj3Ij9cjHEHBwObjectclYWmNt69ahw5NnCf6jrUM51DtpQNE669Ited8`1ResourcesLumenMind.My.ResourcesMySettingsApplicationSettingsBaseSystem.ConfigurationMySettingsPropertyClass10_Patht9IAT0txbjun1XpqvVEMulticastDelegateamXtDctlLPJyLYQIt9uEnumAlQwKwt36JijHR4KG07_Closure$__11-0Class11_InstalliIYCD3tgm62ecDC2tZDClass12_StartupClass13_MeltClass14_AddonsAddonPackageClass15_CompressClass16_Persist_Closure$___Closure$__12-0Class1_PreStartClass2_ComputerClass3_ZoneClass4_ReaderClass5_DecrypterClass6_GetOptionsClass7_GlobalOptionsClass8_AntiVMs_Closure$__3-0Class9_FakeMessageFakeClass1FakeClass2__StaticArrayInitTypeSize=7ValueType__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=18{09D611C0-FB7B-E958-B628-0ADDCF2E3E7D}l92Qhvte7jNUupMGA5KNee3lLtP8VbmE5SidsBW9n75jtfba4aO2tsG2UbMSYVwtGGwmLZCwJCigC2KdUvtuZ1SaKjkVUKmDof5jjL0Oii1uC16N2hrbGRuRLzBKiGsecdgaoAttributeyVvpAV6k4bg2RRVuxGr`1YEjTKn68P9HWZ5AtqGOMcTgfb6LcNZ2SH9o6nMLcA96K66r9oLwoHBARotjdWrY6vgGX0SIBZoGyF8W2p96ISUnNNIFUNKVQttF096X8fOl5kk0KFXW20UfQ6jEDAAOexPPBvxtFYt06xFvdlA04RrdsVmNJKi6ltWSv5sT7jeSs8Oc27639shrQZmMuMHDEA0F16g92CbvOAuTOhsr82VA64DOyQYSqoPTFBaoXE26NbR8GwxlRRXQrNxluY6C2NSDuZ08QDWxeY0pY6MxmYu8BlasfQtvDEBT6euxryXGl6IYPResourceManagerSystem.Resources{DD8F57DE-19D0-43DA-A504-1C2643DFBA30}__StaticArrayInitTypeSize=12__StaticArrayInitTypeSize=22__StaticArrayInitTypeSize=24__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=34__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=256{d24aa7e9-0b1a-45e4-b718-7d48683f9b1a}uQBNJpvNEtT3FhjFyRKm8DE18C78791E831TimeSpanget_DaysExceptionDateTimeget_Nowop_Subtraction.cctorteWpOcvCoQx06PMRHsAVUAZB0vohomM5YCDbxNMmZqcevhE670kKcbNe0ULlYS4v93KbDugxpXRpQ9tGC5vMeAF4Kvisk7kmToXHrve6PbMQHQ5CkLf2UVOAvPbRBPvtMU0L2AD6HDSvHK3uAB74NlUitg0hPjxP1zv19r2X8PjeSME5u5YUserPUiegsYPXHti2DgvfU4NtnsyHAsJpvJxGDuhDYyiti5YC1Bjgm3McN4aAHx4iS1nnTpICMMQOgKOY7ZrvGQUm6Z5mL9GFPfyTOVvuZlnXlOQMdopbk8lrp8lBgKxgyYLcdsqcN0Dw1LvWVoa3c07tFrHpAqSUWFZUYf8nEfEquals RuntimeHelpersGetObjectValueGetHashCodeL7xtvfcXw4TypeGetTypeFromHandleRuntimeTypeHandleToStringEuhtqLYp4qGrPofStwqJLmM8E4RB0mYoZIVtIqAOjGWZJ3QNActivatorCreateInstancegxbtrPsiswEPXS7ctJSfHVRu0NCNiui1rl7qONYOvJX9UDRIwgEts6qaccfWpP5EJeisfLtjC8eBlContextValue`1Microsoft.VisualBasic.MyServices.InternalGLnIaIqsrd7WKumvyZbget_Valueset_ValueLtXG8iqK3qASPouSkVfLBsk9GqFCoeHAoS8ri0JTXeXCtUMyXbD0hSDptBwoPXFOiYKy9H41DosCultureInfoSystem.GlobalizationFTnnqsvWXGtpKZ5LQIvget_ResourceManagerget_AssemblyAssemblyReferenceEqualsget_Cultureset_CultureValueget_CasharkZootByteGetObjectOrMbRhv5ZicXKkJe7yhBj5tlyvypA4PBnniNgLCultureCasharkZootdefaultInstancekgeTDsvEy94pq0j6NZPSettingsBaseSynchronizedget_DefaultVuSCb2vSQij34fcIRVUTrE51CvOhfJmITy7atVDefaultzuFqFhvasx4iWEDWsJAget_Settingsxo4QJqvsbvQ3qWD2qH0SjqtRivKtXva8ek1yWVSettingsecP1FWtSlVersionSMc7D2Xc4RXQTkQhBKYb4dYuMfuCvXmxqOhUqhVn1ZH84WKK9cFvFjJRaqrelIRrDirectorySystem.IOExistsUJSf8JtsUStringBuilderSystem.TextpEKGSAIYFIntPtrZeroSHGetFolderPathintptr_0int_0intptr_1UInt32uint_0stringBuilder_0shell32.dllt2iurHGuqPathCombinep0HWJgGj6GetTempPathDwK5GMDjUGetTempPathWkernel32.dllBj8ykd7oJEnvironmentGetFolderPathSpecialFolderW73E0YiXfArgumentExceptionStringsChrCharAppendIsNullOrEmptySubstringConvertToInt32get_LengthReplaceY5CSaMeOnGFpOWEdsKProcessGetProcessesFunc`2EnumerableSystem.LinqSystem.CoreAnyIEnumerable`1System.Collections.GenericcrYa7T683GetDirectoryNameFileCopyTHFsGMTl8tBqKH7m1WCQvFdADjLget_MinorConcatOperatorsMicrosoft.VisualBasic.CompilerServicesCompareStringget_MajorxpSDiVpiLGetFilesSearchOptionG2DQ2lK05get_ModuleModuleget_FullyQualifiedNames9AcUHGXnIComparer`1CompareGetEnvironmentVariableEndsWithStringComparisonGetFileNameStartsWithIndexOfStringComparerget_OrdinalIgnoreCaseQVpBg2l3kuUeVZRLMkGetDirectoriesgrJ2lhRc9kU7ZlQqspafxb40yVbVXrRAjtMuFiEExTvD9yu7Vs9fTUHmjZoqNvQkT1ZNOK5V59BeginInvokeIAsyncResultpathAsyncCallbackDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultInvokevalue__pattern$VB$Local_nameA67IunqBseybHIqsqp7_Lambda$__0xget_ProcessNameTuQaiBqVeu2lu5mLoiFBdlavfq2LpamJphVIwdFS5r2jvcoK3kCU9giEbDIUYTbax9P6o0YREaNkDhzm9RFxDataGridViewSystem.Windows.Formsget_RowsDataGridViewRowCollectionget_ItemDataGridViewRowget_CellsDataGridViewCellCollectionDataGridViewCellQdgAkgHTA5get_MainModuleProcessModuleget_FileNameProjectDataSetProjectErrorClearProjectErrorget_ExitCodeExitMqnAAOe2ycqn7A8ScFrvKillzqoAtBApupCreateDirectoryDirectoryInfoRandomNextFormatRM8ALVC3oTProcessStartInfoStartset_FileNameset_Argumentsset_UseShellExecuteset_CreateNoWindowset_WindowStyleProcessWindowStyleGCVA6wajGhFormTextBoxButtonPointSystem.DrawingSizeControlset_SizeConversionsButtonBaseset_Textget_Locationget_Xget_Yset_Locationget_WidthMathRoundDoubleget_Heightget_Sizeget_ControlsControlCollectionAddset_StartPositionFormStartPositionClearBindingFlagsget_TextNewLateBindingLateGetAjIAvqdCkVLateIndexGetInitializeArrayArrayRuntimeFieldHandleChangeTypeTSBAqjb9yeThreadSystem.ThreadingSleepCkRAwvwsPuGetDomainAppDomainAT0GLrvBpsxjatISLZLE0V3OPvVLTaItVge3TQcmddatacompatiblex64em5Ydlv2HCchtZZ8oh8VgNAIUBowxRegistryKeyMicrosoft.Win32GetValueContainsIDisposableDisposeRegistryCurrentUserOpenSubKeyx3OArZwq5ULocalMachineWV7AJrnwOIChangeExtensionYBaApKFuM5GuidGetTypeFromCLSIDLateSetLateCallMarshalFinalReleaseComObjectpf9AUkkWq3XqoAiu8njryw0AXZqxB3set_RedirectStandardErroru2461RvZWYBE24SrCLLsN9CZcvbdP6aUeXUQ6nhhpsNPvRqiYeYFx0pyojm3Ajv8qruEmptyPlkAx7KEiUServerComputerget_FileSystemFileSystemProxyMicrosoft.VisualBasic.MyServicesMoveFileQMEAlodYVOqHfA3O47C5ArgumentNullExceptionset_StartInfoc0F7u2v1ptc4LHObhytFFRMVov7a199dvPJ9ATq11RKvvTXwtXKaBJJGaggWAgMDi8vTaskSystem.Threading.TasksDelayWaitDeqA4uKUY9Dictionary`2List`1ToIntegerget_CountjonANeK8TfNKuAC45rhQFileStreamFileModeFileAccessFileShareWritetR6AohlunnNprQaivdLuHdYw5C2pAzxQePmvmgwsB4KIYZWvSZmt4sByJasWDtNbbg3NlaItC5ynE0EOatoD43ldDpethboN2vGPDt9SyxxNXLItMbJmwCR0PtMtqZYE5Mk1KJEMtget_FileBytesset_FileBytesAutoPropertyValueget_Operationset_Operationget_InstallPathset_InstallPathget_ExecutionIntervalset_ExecutionIntervalget_InstallFolderset_InstallFolderget_Delayset_Delayp5J5sWqbcAomj2JgZX6TtTHeZqRlKhm0DHiIkmFileBytesFileNameOperationInstallPathExecutionIntervalInstallFolderIp4AWXt6pwStreamobIA55HF7qs5lAy99bBrkDWAEPHIq7rnQASNYB5BQ8DAO88N2qYRsxKEvnMjKeJyf2tsNstreambufferSizeget_CanWriteget_CanReadCopyTodestinationuABAhwKQFpMemoryStreamDeflateStreamSystem.IO.CompressionCompressionModeToArrayMHFA9kPfN4Readarrayoffsetcountc3kAMfxZCMqa4AetqW7CvY7APrp0IoL0ZAHCQ6slFlushwxNAfro8XiBufferBlockCopyxK6AGubcemNotSupportedExceptionG5uAujACGsObjectDisposedExceptionkl9qomvYQcxA6PZtgruUOrclMv0h6Q8Q4uOsSDOB9ARy1RDxfYykwpvzIcrmerVNjUAlTEAap5FrcGetCurrentProcessWaitForExitS6AAsuHQEdThreadStartset_IsBackgroundJ8mAKOQrd0SelectWhereri9AF42dD9haqADIZcKSaLGAQcqFaNTpaAcThqR7get_IdAppendLineGetEntryAssemblyWriteAllTextNwIABcRGT8ParameterizedThreadStartAbortElementAtOrDefaultget_IsAliveReadLinesz7fAVTawVClGwA2n2AuTHBAAZcfak4qvSAbVK9qeu8fYuFqk2PbbvDCipYfIkxgC1qAkhAUv6hNPup$I$I3-0$I3-1$I11-0$I12-0VIJOwXq1sk133huVYpX_Lambda$__3-0p_Lambda$__3-1n_Lambda$__11-0_Lambda$__12-0wNryQAq7S8CN1jQvgx4EBVw2mqTRDGw2jCAquk$VB$Local_ID$I1u6IUDBqdyltZJxfwONJarg0_Lambda$__1Ck5t6wqmkjuIJqOCie6yWDDydqn6ocwGSaqUsq$VB$Local_PIDCqrIpOqYlYnV94n7MeDbJJvS0q022IWed8uHTWHqMEZQqzaep34Vip0djgk2A7p8l0iyIDMYgq8IEL3qauJ1tLMethod0DataGridViewTextBoxColumnIEnumeratorSystem.CollectionsLabelset_NameHideDataGridViewColumnset_DataPropertyNameset_HeaderTextget_ColumnsDataGridViewColumnCollectionGetEnumeratorget_CurrentMoveNextget_StackTraceInteractionMsgBoxMsgBoxResultMsgBoxStylejb2A1LwsmnTuple`2Enumeratorget_Item1get_Item2TupleCreatewd5BHaqtCPxuFD77uVksmrF5VqLd4EycWQEbYgXdoUjjq6fs1oSgKrDVnLu7AT2GktPoFS0P8qvvHGYf0qxGynrcm1rGqqIOpufJSywvQSHgq4TqwhahV7eMPAOvCNgAdUbc3YMpEAmr427GDeleteFilekernel32NuLAnc04aNumYAYw4uiWG1QY1lqIuBSrKOJ4koFLLjq7bqrxIwo5vZbHPVdgvwj5qJV4doZm6PxMUDw6A0PLipbIList`1ICollection`1Method1BinaryReaderReadByteEncodingget_UTF8CloseglxAzjJVqQInt64ReadInt64ReadInt32ReadSingleSingleReadInt16Int16ReadDoubleReadCharReadUInt64UInt64ReadUInt16UInt16ReadDecimalDecimalReadBooleanJLo8krbgjNReadStringLFO8AaoKNVReadUInt32r0X88yKKZVLxF8t1TJp4ReadByteszyI8L3b3SsToCharArrayN9s86EgObQReadSByteSByteMethod4StackFrameImageCountGetMethodMethodBaseMemberInfoStackTraceGetFramesjSO8vDboVJToj8q6rqqTset_LengthNextBytesEYy8wTHbvkJoinjVw8IbkOiLMinfcW8rZBf65j9i8JJC3uIYl68pDWwh9TrimIl58UBHoNxNTo8jkrbhYget_CurrentThreadget_CurrentUICultureNsU8idr6kIRectangleBitmapBitmapDataSystem.Drawing.ImagingImageFormatget_PngSaveget_Scan0UnlockBitsop_ExplicitkEU8Xuj86BLockBitsImageLockModePixelFormatJO7OPEqp5U18wIuWapaUrHUKyqUejC3UaA1lPR$I13-0Nr2vI3wk6UGbRLnEpki_Lambda$__13-0bnY7DCbwAnR8FZJObNGfeRKPDPw8940VPICydnMf6vyf9qi2Y1pvdGvGH9H5U8l5HTK4CryptoStreamSystem.Security.CryptographyICryptoTransformRijndaelManagedSymmetricAlgorithmset_Keyget_IVCreateDecryptorCryptoStreamModeFlushFinalBlockset_PaddingPaddingModeset_IVset_ModeCipherModecda1ZxqXShpD93fmiV6y7ijO2qjEdbXeMXjowWrRy8gTday0JnvF0xqxmZkxQbTEaTRGCe83XaKs1ToBooleanLpDJg9qlijxqC9fRYk1EMgO2cq3Uh6Q3pXQowJqi184artQ3Gmf8NbxK0kFn88Cw4ynoOIm8ob3XtkBbd8hCYsetNwm89i8C4Dup18MAwbl6UhO8e7CNCGffQ8PiC58dGLg8H5YJRXuU58fCtFf9NUX8GnTTinIPp8uUZNmVXp88WZJ9hkgyp853B5APY1x8yTJcGjGBY8EHbeNtK8b8SxdXOKDqg8OL1Xs7BdM8aO76bss0Y8sSNUYSYKc8KkbhsQDrn8FMCBGUwn48DNJqCBW0T8QVgoGjGwE8cJdQexCtw8BwGOZtNjv8VELItBNXO82yxNDenRD8Zx2GOUqTd8bCv97qn3T8RPulvFAM381RXg4iyWK87sFdXXquD8TrD4DqRUs8diHSvjsmr8mZdb4JioH8nMlay6dHr8YMWMhYCyo80ingP0xC0r2OqgOg4Gkp2KEYfget_Installset_Installget_InstallationRegisteryPathset_InstallationRegisteryPathget_InstallationKeyNameset_InstallationKeyNameget_InstallationDirectoryIndexset_InstallationDirectoryIndexget_InstallationFileNameset_InstallationFileNameget_StartupFolderset_StartupFolderget_InstallationFolderset_InstallationFolderget_HiddenStartupset_HiddenStartupget_HiddenStartupRegset_HiddenStartupRegget_HiddenStartupKeyset_HiddenStartupKeyget_FakeMessageShowset_FakeMessageShowget_FakeMessageIconIndexset_FakeMessageIconIndexget_FakeMessageButtonsIndexset_FakeMessageButtonsIndexget_FakeMessageTitleset_FakeMessageTitleget_FakeMessageBodyset_FakeMessageBodyget_FakeMessageRepetitionset_FakeMessageRepetitionget_AMset_AMget_AntiSandBoxieset_AntiSandBoxieget_Meltset_Meltget_MeltedFileNameset_MeltedFileNameget_InjectionPersistenceset_InjectionPersistenceget_StartupPersistenceset_StartupPersistenceget_WatchDogNameset_WatchDogNameget_WatchDogBytesset_WatchDogBytesget_Compressset_Compressget_ExecutionDelayset_ExecutionDelayget_InjectionHostIndexset_InjectionHostIndexget_MainFileBytesset_MainFileBytesget_BindedFilesNumberset_BindedFilesNumberget_CurrentlyInstalledset_CurrentlyInstalledget_InstallationPathset_InstallationPathget_StartupMethodset_StartupMethodget_TempFolderset_TempFolderget_HostPathset_HostPathget_KeepAliveset_KeepAliveget_PIDset_PIDget_Assmblyset_Assmblyget_METset_METget_Typset_TypvTL21Cq4COsiGija5iWGZUwGSqNHIK1hv6QrnyInstallInstallationRegisteryPathInstallationKeyNameInstallationDirectoryIndexInstallationFileNameStartupFolderInstallationFolderHiddenStartupHiddenStartupRegHiddenStartupKeyFakeMessageShowFakeMessageIconIndexFakeMessageButtonsIndexFakeMessageTitleFakeMessageBodyFakeMessageRepetitionAMAntiSandBoxieMeltMeltedFileNameInjectionPersistenceStartupPersistenceWatchDogNameWatchDogBytesCompressExecutionDelayInjectionHostIndexMainFileBytesBindedFilesNumberCurrentlyInstalledInstallationPathStartupMethodTempFolderHostPathKeepAlivePIDAssmblyMETTypFtorWmqCdVuCpe9QPx1KvA8zrghNKLN8tktgOGjPropertyInfoToLowerGetPropertyiFUtANAlylReverseOpenBaseKeyRegistryHiveRegistryViewS0gxpiqoXZJrQcWfwMphsWCw6qh6gsGAo3N00a$VB$Local_nisateTwlkBwtZZdDKAvBKt6O0DmB3wLNjNx8oCSs57HPd7HGw6KQHORNs5ZyUdhVpKWq9ATw7S1MKEIGTDrt8S2peSWw7ttWTTNiMessageBoxShowDialogResultMessageBoxButtonsMessageBoxIconalRtLI239NM6hF9mqMZOP8yjXaCucpaSfbjqe2IpQMobMTj6m4okobqPjURsrqYV4mVPX9mFfqHO4vFPQ9WRwhL89Nwbqfk5VM7Gq7mCGWTnZOHqGIinK8hmcld6iusxKsquHhH78ArqcwEmpOhMRqWetorIUV01Tg72EE304A14DF2EBB2F46C7BE32E6AF1EB05E35609BFD3ED98B0D60CEE23092B2AAC88F20958E7F1DA1B1EC06FCF802E18CDF293750BB225E1BE87C2F109DE82CB7A81FA721CC24AF588CA58474D43542AFC7EF917AE82418ED9785F4830B7DA6XlZtHmZRX9HULSaawlsQksopUTULtqTWIhto7uytypemdtFieldInfoMethodInfoDelegateCreateDelegateSetValueResolveTypeget_MetadataTokenResolveMethodGetFieldsget_ManifestModulecGYWTQw35gaD6dcNq7ERTl49gwg25KQZ9L8G2docallbackobjectresults54Lg7mpOTjDwL4NdhkfjKELCGDjGUWUNLGjPfSGY3ULu430KhoocLy10LILORlLE6rU6nqZ3LSx7svfqOhLOsuUnboXpLDNuBrRUQ9LcGVSF1a7sLB0WHc5PvTLb4PJAnyjtLRxFB4VFnRL1WDNYSUBrL7yGxUyJMELTVGO3mj5WLdgIZotlMRLKfxZ2kRrbLhRPShctgELQmHaKnEWYLYXg7qhiwBL9ZvsYcOOpLFE85WTXWxLNSHSFDRu5LmA0IopzRBL2lkhPtCO9LeVQRimSYALsb2LESojQLHUXHI3KkuLWfDjb9nq0LfaeKwiRcyLatqKdGTwdLoOTf35xi9LPhpUpRH5wLZZLfxpDkRLV87FmyHAKL509RdktHTLM5l8gUCLKLnT3qSDSortedListHashtableRSACryptoServiceProviderset_UseMachineKeyStoreOh2I9psVsTC7ftWMOrj0BitConverterGetBytesd17t5chBNfzYOtyhLucErS6tEI3dwOJ4atSiqZubCs3tO57cM7SwWta3moUgf6nts4PcjjBwUtKm9n39AesCryptoServiceProviderObjectHandleSystem.Runtime.RemotingUnwrapmvctF6whc5MD5CryptoServiceProviderCryptoConfigget_AllowOnlyFipsAlgorithmsQ3ktDSksnHHashAlgorithmComputeHashfrdtQALLlprxdtc2bbPxTransformBlocklEwtBUCRiyget_BaseStreamset_PositionYTetVJcqifParameterInfoDynamicMethodSystem.Reflection.EmitILGeneratorMonitorEnterGetManifestResourceStreamGetGenericArgumentsget_IsStaticget_FieldTypeGetParametersget_DeclaringTypeget_IsValueTypeMakeByRefTypeget_ParameterTypeget_ReturnTypeGetILGeneratorOpCodeOpCodesLdarg_0EmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetpvDtZhVtJDcyLtbR9QoqYU6tRy7NpHt4Kt1wdnsmzUkt7aB8PhAssemblyNameop_InequalityGetNameget_NameGetReferencedAssembliesop_Equalityget_UnicodeGetStringQr6tTu5XnIFromBase64Stringthhtd1djtZwC8tm75bRjtUptnu8gI1z5utYgwlPdget_CodeBaseGetTypeOIwt0px6rRLoadLibrarykvYtzPPSgdGetProcAddressRqxLkISXBuGetDelegateForFunctionPointernGULATwO7kvYxL8WIg5tAFtLtcupSWyJrLLQYDDFCp0L60YnE1BrtYkO4iffAjLv23HZpJjoLqMVwV8mVmLw9sJquT3ALIWlQUeQaYLrRZJWbTddLJYjRKgeEmLpPJIZNIKPLUnJ9vjDWPLiLbSXdOj4LXQ9Efql4ALjrhNmRk3MLxBxg33j3ELlcZN8sFlQL3kviGXgkKdMlvLJeqTOTWZMGXYts3U1v6C9lKhGed9e1zjuQ5Cvvxvbf8HljM8IcYVnLEvqWBQWYKZsLB4NhBlPEvwIfZWM0RNvFUG6yFPdvI0tIxAfx0a0uyISqMvvrL9o3l2Uc4dbsgbkuQvJb2ANc60aExFGetPublicKeyTokenSbpPkovpt1yCW4S4heJmU7xRdvUue5NwAg99q2N8JwQuvilJCFd5XQN28vGLA9LvXIMZhtmpvqOWVZo7Wdvjk76i6n6j6IefR4afDvxE92UogBoq14bvGneLvl5FtLae9RZyTBpKmWKv3B1g8LFWxmF5j1NWllvgI7GodtVeKgPget_EntryPointlvW0udv4XUYZh3FL6DUBvaSmHv8U9q2VDeNh2BG9DR7wvtZo9O65XEZFCeAlnRUwon0N8YNyIySkJe13OGwh6mx9a9k3B5wx6u5Lvw98VGx9TV0CmlbngVgm6AM8qhr2duNVtkRT6tRh0RlCreateEncryptorToBase64StringclassthiscompinfoflagsnativeEntrynativeSizeOfCodeLKm6qSvqXjIeq6wBjo8GBsL6il6PPYmpep2xkqqrjyd6rMhCIenX16JAFwQwuv46pou8NXzlI6UG8vEGhModulelpNamelpTypelpAddressdwSizeflAllocationTypeflProtecthProcesslpBaseAddressbuffersizelpNumberOfBytesWrittenflNewProtectlpflOldProtectdwDesiredAccessbInheritHandledwProcessIdptrhx86otnagcNcqG5uwOcX4bHIPUMVPG1SIMJ0J8FAbsSRwrIFwa5jLN5QmbTvCQYmDucwsBZeoxMa5iUIOYs6P1KUgVF5B6HGodRoWS86fRnK1LsJK6GL0gnDX4iDSJwQn9IAQMcH7upLoadGetManifestResourceNamesset_ItemInternalGetResourceSetResourceSetMainAssemblyGetResourceFileNameget_InvariantCultureTryGetValueGetNeutralResourcesLanguageDAnaUAwcJm1eP7ia1lad9k15gwBDHxxSBZVw4N03DCEB56B5842C722DE2821DA9906CD70AB73267EAB1A3947BFD894D19372BC70E448EF5E5E60630BDDB19388CB6378436E3C65D03DD66DA7C6EBFF563BD857A128605DD5EC3F87EB915E0EDA22D0F52C595C0CF7986D911ED2CA1C403FB7B834BED3ADC52D4904075F6BBF279EC4ACEDE079533B95E229A29809542EA324A7B59058FDDE6089BCA6236FD2AE2D98B3ABB38A7BC80D8DD4C75CEFD7A5D24707462E6F13B53D67FDD780E20D89A6E8EE503B197AC16AC3F1D2571C147FDD324C9742EB14EC82FD7DCE8A8B8165C5AE7AABD3935C69B50E82F066C4890BD7C5D1F7F535673D836D3D77A97DB03EB3D71EA780F44372F5AEBECEBEDD696AAEB8378841F6FF48991C286754FBA5647CA30986070C8F457C22D30959D113010CC164C97E613E5A3A47DEC76B7E50D47644B35EA4322F00D594D80D2F1C1F3644F8A4AC356AFF1A01C2B0DA472E584C8E3C8F875B9A24280435D42836A77B19F5A8C18C61B1941CF756EB7551F7C661743802362728B785ADC22E860D269713DFB01A6D5B7247C497788CF0031CEB06E3DF77A45FEF59F1E49633DC7159816D64759B5F1C3EBE78BD8C38559BF3CFCC9A9FA37D221E31780774A3787E26160A61F5348m_2bb77771f1194d7bb5fc4ee6c65abb67m_977ebe1d3a974e20b643d661d2b3bc6em_427fe85061c34f5cb5cb8c072b0702e0m_f99c9c3f6fb8420e9d122f6143b558b8m_916c6e214ce245da9215988899d92320m_49fb31b5519b49fc9fd0731dd90083e5m_2d29ef59a3dc492ea65c47eef52c5195m_f6ab5d7d56194d259bfea34631a3f1c9m_42be05b381d2416cac0da079e57fcef9m_668ddfbe4311428297e81c17ed42b7c0m_595bf9f5226e44bfb98da58b7243c63fm_9412ab3683454866adb818d7c55d71eem_17beb25117b846ad9e05e570386a30d8m_ff394e88411643f9927ed919fb763632m_3614cb50349b4a028a3438e83fffd9bem_30c0af7ad0104d93aa4673ccfb5dceb0m_d4fbc3c93e2f4802ae9874cb6754ee28m_277060b366f3495aab56584223fe8506m_bdfb964add0940f38c017a9b92f34181m_bccc20c9a20547cd83a186330efe481bm_f919314f1df34cbeb8b62e0ced77699fm_9a0f11b6daca4c91a0e4187800e5fcb5m_31c567739ec94bcb8abfa046c16ab460m_54d4b0fc4b25465eb3cf189ae79dabe9m_012497530cfa4abea53bfa385d2f9693m_3a18bfc1b89b4870b208eb4e3a3859ccm_65b622de117749778d8db60695de6312m_8e74349745854e1eaaba4a359b7035d7m_0f1776a743094cd69e561eac08d4d2ddm_7a09709bf2014a5abdc5b27c977c0ec6m_e411d93baf01470ab5a6279bfc0b1a94m_f5a595b2002c471789696ddacf371bffm_42766d48613444d1afad1e73c2c233b2m_c1db8706de26425ea34e1578e835091am_fc0d74330ec94d63b340b7441563b3a2m_3a985ae25a41498b9135aee654f2adfcm_39962eea08774990a215c0aeb190f6f0m_8c1c4e81619044838a6886943b62966am_81fab390ecfd4d4b8be10a66bdb43060m_23b8c5b2c36d4a61a641c23a45971bb0m_d254a2c3b08b47469021f0dd836e5965m_3a0ec8c0b1a4471ebbd8f72f3d700db2m_5e120a674b90428380d20d115755c25bm_533d37f04acb40dda724816b00405196m_3ae2040f316140fe8625a201506b1ef2m_aab4d11255e54b8faccf9de0caf04cb7m_2adca4b5f71a43ee925af2c2d5972d4cm_abc990e59ac544aca595f47d2c4a8ee9m_9398e0c3f5ec41cda28846d12f70f333m_4b9d835d77d94a81a7ee292004a5a3bdm_84d7dd69e76d4123813612d5115563dam_1e946a2db2294773a810bc5796ee95eem_5ab72f52bd4e419fad50bcb582b2b775m_dc6c8df79fd44256817a28869dc67c40m_b7ecc9decf274a699ce9f42ee7bb0a29m_5150e61778744a8ba872bdaa939107e3m_d305937970cc4b978ae1600374e8cdbam_251a4e9948e246bdbf2419efbf8faa47m_88c16fd58e784ce3baed674bde794336m_437123805a5149669dc1f7fc39895565m_f22a2a316be04730815bc4286ddf47c6m_e1eaf7bb8e9143b7b7e37eae85c91e0bm_ffb8f22f92ec48519b43903e349d0371m_12ff4cbfe80f4adf82b568150c800bb2m_547dd095eaa54e8ab052ba773a680481m_620d39fc07364a3382fc018942e320d0m_ad0470e9067d4b92a0fb0a80577c7285m_c27962834fad4eb1a7ecb0ee46185434m_c90a9dbaadbc452eb7ad2edd4cbd551cm_dd2623844ae34228b89eb36ccb1a0269m_260a35b6d1ae460bbcc7f14e9418c393m_722864934b804636844e13c4a4be9582m_4d520b4c644441be8a08f6197061552fm_38b12b7e8b9847e2b06c35981d50f10em_4fd79180e87144ebbc62fb32700d3231m_1616441bcbca46ed8279bfc0ea564937m_0b7c025447124680a4df2216116bdf20m_745de6cfcb8d4203954453cc656ba154m_a750a3f1c04f47a791103b4204196f68m_363739932d8346e49f5c9346416a1047m_0a98b4ed6bac488ab5f37c72b0374afem_13ffb1a9418a4c2ba09b7f799b578488m_c717641f3ffd43ada778eb7d14551063m_d08fff94cd7640d891bbf53b09adc654m_f0875fac38e44b87826f783cd28aa1e0m_dfdd11e618c644cba7864a2d1022a076m_15dad470b5e642b1821aa70676971e5fm_8ce7a0f6c9d74c3c99abe06b5418cbdam_e08c3971e39a4d70bee80c5058fe9c76m_8ab0c0e930fc4141af61a880fc2e6fe9m_a7dfe213264f4da6a5c7b6f054134d7fm_93835ff2b7d44796a1c1815175e4c32em_b15afd7e475f493b8c7890ce006a236bm_8e24efa681854ef4ada055c55bedf37cm_cd1b398bde904155a936e6a05bc27084m_d14d60b7639a4d50b8757cafc8bc716fm_87781b4bacd74397ae9f5fdf733b1656m_b70e1c29550545549b4e1d1a30ba08efm_929c61cdeab24d2b8d4759c74b902ab1m_17a017263cfe4bc999f6457e01025b2bm_56735c04f4c44f578118f6e5935e55dam_cba3e7aabfe444c299c7fb7a93f89fc2m_b08f3d5aebd74629ba56f28f6dcc9446m_52b5e29ac93541c8983ec5661fbc211bm_5b831beec9134bb886a7d6f004a1d17fm_cf18c6455a514abeb206c41f96cb0167m_62f0e651d8a449af8d62248e5e88f818m_a4873cbe61414c71acf5bc9d15114b23m_a0ea2b205ff049518ea4263bb6c449ddm_1444cfd83ec1409f80627f0e7443087am_5252f7f196d64f69b94f31de4b090879m_39c24e029dac4234b64debff7a44560em_0b47eeef086f4bd4aa2bd92eeca60365ExS9QmINxclTxaNP84Sq672ab61c19f744d6906bfefcd32a2926ToZqgLICFTW9MDjwjasqUsr2eIoTeqhUtrfkjeGeneratedCodeAttributeSystem.CodeDom.CompilerEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateDebuggerHiddenAttributeStandardModuleAttributeHideModuleNameAttributeHelpKeywordAttributeSystem.ComponentModel.DesignDebuggerNonUserCodeAttributeCompilerGeneratedAttributeDebuggerBrowsableAttributeDebuggerBrowsableStateMyGroupCollectionAttributeUnmanagedFunctionPointerAttributeCallingConventionCharSetFlagsAttributeObfuscationAttribute4FU0T2AIc0FUZky3fl.Xm17qI8To89h23SAgrLumenMind.Resources.resourcesLumenMind.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resourcesThis assembly is protected by an unregistered version of Eziriz's ".NET Reactor"! This assembly won't further work.System.Core Version=3.5.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.AesCryptoServiceProviderSystem.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089KxHivZsJ6A8cOOcqAZX.gQluoJpc9akJv8ldGC#apa5pCcBtPy7loDyyK4FU0T2AIc0FUZky3fl.Xm17qI8To89h23SAgr#RfhZyyIap7vSmdO80;GetDelegateForFunctionPointerfile:///LocationFind ResourceAVirtual Alloc Write Process MemoryProtectOpen Process Close Handlekernel 32.dll)KfgyPK7kFS0dl2cFcnL6%pJb9W1YXus2KPFcrV2+oU9xFyOZ5sp7qKGPLVlOp'Dsv42yWteKACMVLLQ38-4G3hBsSScVb9Zld2rBAaH5+bEczp4piv0HC43Zi5DpCw+LIGIFpqwkqNltv8iU5Rh2dH9IL9PEF2MvPuYh aKE6#7z\V4 TWrapNonExceptionThrows LumenMind Voxel QLLumenMind randomize timing between stimuli to prevent rhythm-based guessing. LumenMindThryvIQ"Copyright © 2025 LumenMind. Retarlidaz™ )$f4b13de7-0849-40a7-8d50-915a5bcd24732.4.8.1I.NETFramework,Version=v4.6TFrameworkDisplayName.NET Framework 4.6?_ :u } u}} 0 qqqq q $ $4,( GE 8 0000 0 44 ( 8 8< !y ) 11 59=A=E I E E a M eA qu }< D DH 1HLPP PP LP P(((T qq TXy y y `dX\ \` ``d dd hH"9M==AAy % hlylppt } 1 } } % 9q= 9 A 9 - - qq y %=MQU=Y Y UE I EI UMU UM]atx x|!eiym i iu y }| (( A qq E& i A iA q i q} q u $ ,(00 MyTemplate11.0.0.0 My.ComputerMy.ApplicationMy.UserMy.WebServicesA3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.12.0.0My.Settings a4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__ PC2KdUvtuZ1SaKjkVUKm.bMSYVwtGGwmLZCwJCig+rbGRuRLzBKiGsecdgao+yVvpAV6k4bg2RRVuxGr`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][] %SUsSystem.Runtime.InteropServices.CharSet, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089CharSet;TFeatureEZNRMERMTExcludeTStripAfterObfuscation6Y>KI=)c6&N1} NhK+$ʂSd!囘/= 6_`J ڷJ]LHU. zERp1nfm,!z#ڂɨT[SA` =h!JٹNFOyD xءT7+xdC6X 3k˭Y`*u8U(UZEkQܔ^x-ׇ2Āg6c͠2jNi|b<^]4HJ3#O Ӿz:$<92^ǈY=:Ize(f)I|?X+ZOKP?/_S'eǷbh U昍yM^xᬍ;gx+yd9UhѾ+u4$I0~\&w{'eE j*r i=qYscUET'0) uNi؎Fr1j;|}k$^zPT%CLK0Df\Zᖎ͞jE{S Q!Њ6b@o$+ w.]`rfsP+zMk&HwhP]+`TdR$$#b3DoGm-`mCɤfmQ~0?m. +pDNc4j:!ssvPPgx5)>eG$>s`t{P*a]Mcv)PG)|_IBLI"k֫wP٬xҿ`!k:>nz4]:GlyU{ (29aZť}yBA`[e#Go^*f9'O/CK(Fm ZT{x;`{Scf?\?䦤~ٶNƍŸsu{uV[߲9!ڍki G%d܇V 3y9\t4uNogК386coWQb4.>^6Է7dUm_}.t6!$˸ibXYhj)K)[$n@HQ+Dz_ߏ凉M"j)PW3_y:exLceuv\2;~ExLRV]Ӂ.^ѱ˽M+5694N#&aԾ^q 0To$?M-l֦nB1t9*g' 3.j3\nzjAsF+&u,_zd=yͯӞ5gXbXBΊC/0I4ןTǡȊ'6"5LeOY$Ddb*C+}ߍI1Cv3zy~#'/ȟ#vvxj/) (rڶyC/NL93#b).S6 >_\Ϯ(YѬIӻ]ո~~E{H5H9 $ӷ6{(m_xOx_&?lf1Dz%]{4ڻ߰)y[VwJ5IeT#g)G#WK3K+ИdWI}"u0 3uʮi+}"Cqq}** s{CzayNȸmucuVFY 6*aX&= HNDАtq*xI]]򫹆<ƁW@Iڣ6dHYXbJ QVWZeY;;KƮNϏo[$K5ItVb1T[JjIyi]v~TxFdӹ= Z^do)W]`MW4kVϥ۸lΆ839T[E"Q ϒ&<}I$*3p^n"Rtq+ kf?8`qFK?9xJpaФU^R= M³ҽ6S[O_tVݩl^S܅Ni`*ioeu]8[ҌS~ UDs {AJi߫ބUZom4}FbWYV\5s6y՝ KOI'Pt~uARC7ex^DԾ߈Jxт$p.rdOقW793n|ah&@ҪZ1i rLMҡҺ|v"\0t%-8\]A9VuBjU;$ C+GIb!b2 se@M2U3Cǁ8!P$ k.AV&M瞧-O$c^nq'VY]s"Vk&>%dҶ-wϯ;qgOqD@<쟥h)|Υ}k"'jG'x 1GQOi+-s]} qpT2ۃ#~^ݗ^6#E&33OKa;)5.|siN˦<΄e'źP|Zՙ>c}+b嘂= vcΦzzE'w ]) }8Ui2JcƎB" >i%dW^%n%rtr-;Փv&>>=MWY+);Ke~ex}!ąӺ^HjjmzmI왩mr͸sjWa 4 9/R(F1 a$}Du|&uS('Տ&3#`:ݔ]M%eדkYԲqُTS%Xlhֹw:'nymjYT!%v!~-ݹ ǬŮ+Uf-N)ݍjʽfTXg8& }e譻0Ԝ_!Lbjr '0_KG܂z3X:e=Tpۀ*(flSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPUQCasharkZoot E!nE"p$E"n"nE"nE"nE"nE"nEn 9#ã̠ Q7CN+MN7WNmN cМE"n""|XE"nGo"nE"nE"nD"ne"nA"nE$nE"G"nF"E"nU"~E"~E"nE>oE"NTA"nE"nE"nD"nE"nE"nE"nE"nE"nE"nE"nE"nE"nMnE"nE"E"EnE"nE"nE"NkPEnD"h"nE"nEbn N E"nE n E"nE"nE"nE"nE"nD"nE"lenE#nE"nE"nE"nE"nE"nE"nE"nE+?iTV-iniIE RỔձK)/yTgh4{'%v&`s͑j$)G>$.3&wv4w^8&{7)B`W,B5Uf9ڍcHӨw"M4_7FW?9DNsi N5 r:]&> Go0@yAR=k GÛ1eVTuDj8n6xa;ٟOOELCn *IS:XѿmƹF7]Fp@ܸ=IT/)ᦠ mڜ)5>N }az\3bF7 f墳TFm8p뚢Ď|@Vx}J[ rv -L ]<;քEIߔr]"C5`zDYaw=.sDruQ-Z.쀈Y[.^ nMR}@pGN2>RNLuI79LPӐ8?מ4A8D$|k[ V#=nH2heT=C!VhKMjeВ#WQvtJ\#։ܣVue!j~1` WRܛ-@o% &stWcBe/XcZ2QN ~O!)%e֎:~*F>$܌@g3o+0%d(:1Y.؞? J-f_ҍ {kUo1x2Qb+0r`m[<{wB7:~V^1;|/DSXl]JYlJmK МE"d%JgfS /;kDK xSpQϲƬKՔ3OqM>iHt5ۃXk0iQ,+ovwؖbi[eI DX7vmr=^Š8y~P#UNʪ4h`OuyR-EN$ \5>lMWHz(tijddZ"ύJ-̧&RYWשmSgjK_ټleHz"(2$/K`TP^ &KM;'kHxE$q)YJ!0:fhѽ'9O$CރLC'/w¢%Hnͯ%uPQpn>[m {ao)cK`^GU_Dbw(qH[ŪĞEcnE3Nevyvbgn|plS"n_"h 84EE"ܞE"DVnE n+lFn(_6m&nԌFn5m`4_7m'nVC"h"ne"$tE"cG"nECne ~ܞE"iN"oe<~ܟE"FCfm+nؔeѷC_>|c*7LCܖE"fͺ#RNC F"hE(e`5bQ nE"^D"mGWnCobpNuXKgnE"k"nJEknOcݩnE""nEn̕D"zE"O nBEecT˾ nMh"6n$X`NfqxVc$FC%0^9}|pU"hE$N lCx%c$Αm5nT`cݛFCn\p܊E"C*sNKYnҤpE"|BfepnpE$fҷ-0EL;KZpNE n yFbݤu!iD"܁E"D@"nE"l["dE1jE"nF nVnE#nAMnE"}M"nT O^E"oG nE1mE"n6nޜVnE#n*nޏu&fD"a"dF"nE"FOnğE%nE3FO}C"nT nE"^E"om nޜE1mE"n*nޜVnE&no"d燲E"e ޯ3,F$fB"nELnbE"@E""neE"h۔e;0ѷCFc 6gN+x>X*$bB3K@3qN3ы1!f"oȿNC4@VA c3w*jI/e2O䕤pIFc\@c< cT$ M9se%宼L(~ʻpj*b-` N!sV c3t*jIute8ܑTXpO3qaZ(sewT،gp1Pz4Y:yV c3y*jC:ha]HÏ"rBaݞgMܾn$U`cenyE"K=E&AN3N x$C3iLz1N5ؓC=*gxT.@<}rZ,h M=jC=*axT. z9?}&rRzd3#nL`ݞhXsxT$ M`1qJ"nEpn훝E"}nD"kh"nEwnsE"lD"cX"nElCnT%_ni`ND'CE&A8FO3Niv^xb$+5]戋KkҤp?D"ueIǮL;̰pA y\n`5~e'BoG6 Z2E&KEvmn犝E"l囨E"FOnT%OfO}qSHfEsWK;phk*'\` N)\1N`4pA xE"FO3N} x9*$ѐ#nBPpe2npE&KEoG6 [@A y=E"lU"qV&oG6 ;#nRzn|%\n`5~eU@A y=癕#n܁E"O3FO1Գj4ͯVr c3N*x^y$ZVc 24rVc$vڔe8ѷC$Xc3Nq90xVc5oH\nL4qr^ nSnT%K@}qRHfKfcEQpK|p^ nt"dw"dD"jS3tܬE"QE"e-ѷԛ0O{obݝoE"Բ?4Ht0Vm c\n`5~eD"jы2;#nRzn|'BoG6 Z:e}{̭pA y\n`5~e'BoG6 Z2E&KEvA\n`5~eD"jы2;#nRzn|'BoG6 Z:B ee޻|ᕤp뚅/NNĜ7hr~:H~aݍqT%'n}PrVnE$nCj(OoKT|#nE'nΝE"lG"p#nEvnBE"lG"pEnG"^ nt"dw"dBy'e}>pbP#ne|lcpA y\n`5~e'BoG6 Z2E&KEvmn犝E"l囨E"FOnT%iթ6}qe8󮼨[~plE$vǔeХѷCŁ|c3N@IxVW c$wǔe6}lѷCHc/B edwpcݰ1Bg+ea4p뚊/Ns2?h?5HգboG6 ;#nRzn|%\n`5~eU@A y=;#nRzn|E"lU"pD"jы2%\n`5~e]@}e4!nVpQE"eԘ6I3[aoG+E9^L4,oN3N~x9X$Z4͘V c4jT.P *}rE"D_jm nIU@7eqVpLtԋ}iaݞb͢PN|oCcT$eNqa3qZ.f $hC=CT$`xK%!ɧ(j`ݞbR+NT*hCcT&h۔eTѷC`cL= Qի`ݞiRzkUF]$mH~`ݞgMe+n$kZ`LcT$aJqa3NHxv$C9ha^倪ԝgݞfM%n$Y `cT$ M5s]3vxC0_{4͊[yVqc3aN3ы1&e PpC4fa3Nnkxz٠$ЕC>haYiAԚ^5մgݞh_txT.C+f(}tZ+h M=jC=*dxT.x p3 }uZ2}evOƍ/TJpFO6qhCQn|"d-B YfݥnĘErnE3m*n~"dȜE(Y~<A$wE"yG"n c ANm*>x\g$ AzA"nE"lE"ko1hNE"n>+n! k(Q3e qN=0E"n}E"h#nE nE"o_p}Gn>*nFYni"d?M"jBl14ͪ*nFYni"d?M"jL"jL"jx4_Vc4NzݑC_nGYnE*nE"78'nL"jE#fҁEW-K[xBpL"jL"j@ 4͠UV c!A$A A k^FA!ge"nex ѷCc%ECcFgC{geypmE&ZAKUfқeN}|qE"^E"oG!iG5q nE"DVnbE%neBf7gnHpl"nE3nE"0J4ccE%C"j{E"FC$yE"q/ Nth%TpH{RziAcRN%Cco"^E"fR(A)83e"B\I9+EpE"nE"HndNrx\$ CiŔe~bѷC5c 8h>$nG"lܿE"6),lnyE"q}"nT5Nl[.Ti`1qL"nCE'nE"nE"S"nEp5E"h䬖T&1Td%nyAeꕷ3N8Hyx^7?$ iZ}.je4N[DCcM ij*,4U` Nۡ Vc hCnmnWcݙeA(Xe%9Xpޏu$L"wZJ͑|&KL|gpErnԜE"nE"W""nDE+nF$G&MH$Գ_EFM=1T&_/S!ngAPkeI>pI3N[x($@NVw/hݻWHոcݞjMNHZCWcM5b7rjWc݈D@"7nE"lE"NJ#'U`)0E"nE"l%"nEn$cݤM#5n$;;`M"j>(n雰E"E"Njc hBF eU╷4i5>yN~CcG4fG7gB[?OesL+pA"nE"lE"DęEnE3M¯t>]$uE"c"nE nМE"M"j>(n雰E"E"N 6lE"pE"hͥϦNuW=CE"NDNTKh KHՏcݥnu$N"E"dͥЍx$k,n폜E"nE""nEnE"nD"\"n_cn̰D"lE&xem;ҌC@c}qu*L8` NqV9 c$ X-^V+ c%7V&kh/\N(CcCnMn$XN`k9yXrbݍiE&DF"nE"lɜE(nęEnE3N-EnN"j\E"G_nZ.l8/nInK"j nE"lG"lE&C_n6n뉎E"lE$}G=G_n_nP"jE"A W85n6n뉇E"lɜE({E&d>7n6nPE"hCHE"^/E"iGYn~neICNCeC"nEXn cnE"PnZA$*BXj,es A5P88n󼟣%EMo>8nԜU"FO(NT@x"c$F_ney#?ȌúpD@"nE"lE&jΜE$n@"nE"y@lE&C yCMnC5An@"olE"lE&C }A v*gnޯ6kNC%Cc5nE"oE"w`#nEnE"oE"#nFEnE"DnD""nwE n{cݬl neƽu 2piE"X:rKcҤpBzlE&G ncݍAMn>5n雫E"g[ WNl|yC{cGYn nܾE"NFaue6qtplE&US(NQ6\xåZ$F>,nG"l֜E$NdFxԣt$)>7nF"lќE$y=sb݉t9ߚe(&Ѻ}MqH"j{E"FC+~}nqI"j{E"FC%60ѷԋbݍA$lmn=h_;-ܔb݉qeѷCR5cfe>b>U4KplE&G nRzg1ԋNCCcS(N"-.x$ZPfQMEwqdKpgn{E"lE&MRN<$hͷbgHՃbݞkM%n$`3cW"q{G3N9\x@$͐>1nE"lE&DT-M3(};qR"jE"囤E"vevdpiE"lE&I)aDNĶCcB xT 7؜E$nT*G xmnؔe8ѷC#c3NdxV c3NxRIS$A1gџ:a݈ba#-hcB tr*&` N&64|p1ю4vJhV+c0FC3N4xxx$#>1nNMnn``ݍA3FCn>4nܺE"}e5<$plE&An>4nܿE"BԴ%KukҤupGYnV*N}8smonW"jE"xE"}V"j"h/zk:UjJuF#gݞaCCNaМCcW">T-5y'E%3}tW"jE"虍OMnL{ګp@,}T$f7\E Ke }tV"jE$͢O}jtI"j돱E"tn>4nܿE"B2-nh"jbE A nMJ¹n$`-c] GYnMMnV)nźE$a`툽N:7C|cB7f͋~avEԣgXKfplE&gE$ϝ}vK"j돱E"G xmnؔehѷC<5ݹc3NmxVE c3t?֥ߚeѺT-~w CcW"?i*su` N9D4pxeJLo";r}׼pxJ@BBe.ppꚍ@Nlh̀bHeݍA4$V(a('NlFCcT/NfbH5y]3yK=1J'eq"npE"hٜE&bE A nT-+}wZ,f1Eԣ#KKe*w}RwT-d }ywT)6J0WeU[pJ,x enpedݞa͕NɖCkcB zB37>4nm n묗T-LVFZ}xT- sΥ}xN3NE7x$$$E1hĝE"nSgl_>KN|epEďn휜E"nE""nzEon%E"T'n;e\TnmjZ}6RzjͮOt"hGaz])ՂcݍiܬE"l4͕ЬNVc4jk0ձcݞjƔe _ѷCy0͹cSgч)5e/PGE̐plܳE"}4ɷװV c44@&V0 c^E"oG:~ԆIN{!CdA"nEn(cݍnk ZiKI}ҚeOCnD͹4dhhE\E1kVE"n>n62؀"XK$n cnE"RG"nE lE&wМE$+mC5dԊzI}4,LE_q*"/` NͧEpe.}}z>?n6nPE"NIUF_nE"^uE"iG^ng"h80$pE"c"nE'n퍜E"n5E" }nBvĐHe|Q OmnZv!!U9nܾE"ifeNCg"j.ߚe|Ѻ}Hp*T:ԃSլcݍA$mmn["j{E"FC$6$Vcn@"nnE"lE&FCMn1&;j]K%nfE"nLpk"nEJnE"lE&G!Ho%fZnpG^nmn묖epC pAnmn묖BlZe8(pE"mלE$f0E.fK.ȷp c݉DVnE#nUnX"j!nE"lE"A So"nĚEBnE3A!nQ0lEKgnD""nEOnE"gn#pI"nZEo>nM\ ͹n$:`NGamxEpF=18n8n>na"j@lyE"A*5A}up8na PVc JFN2Zh_HHԴ 4̽pxM?T hIc݇Nsx$t>nM"lŴE$y>_1(b݈hߚe")LѺ}qޔee"VT-pDęEnE3lќE&AzqS)eq|I>+E3nE"nHpPc"nƻe__TB$fqEpK/GYn*nE"N퇓 iMenFJ}d"nT!A}A=1GYnZ= ޜE"^E"oGYnA'R*n"hVnE#nf"jmn{E"m"hA"nE"lE"l8nޜE"^E"dS(?eE_k1N>+E7nڜE"nE"cG"nƧRzikhNM0CԜF"A}H/Kуҷ%-#O3znA$lmnԆ]Eiޏu'B"J͵.zUK&n(cݯnE"lnyb"j{E"mלE$d͐T1ԜD"Z^9KTқeݮnVnE.ne)O|d"nEFnoE"nE"@"n@EpGE"iǔeX*VѷCVc+|JCԜD"ZԣK`Uҷ& eq)CoMn$h` cA5>n͌VK$n cnE"FW"nE Dmy4/RE*8n^{E>ni"j2ߚeYѺB$ lޜE&A ECMn:՜cݍlݜE&Eo"^D"aGYn5d͜ 0$qO"n.c'nڜE">niE"x"n-En)E"S(N)@KxX;$ =hE"6|{ԖpEnGYnMh{n$Yq`N@xVc FG GN%6ݜE&lܜE&KԾA Br* q` NFnVc )MMeGRpU l]}*p>nÔes4AѷCy)cdSNhx޺H'bݥnC"nE"lܜE&lݜE&hl"jep7gn@pl{"nE lݜE&AN_;h߄eHMo4$G ne~xG0fɌ?o1jE"n>nR{hE"YH>Nk8 CeF"n c nE"vi"je :@.WGYn}M"nT A^4E"oGYnq@Ee녕O>+E?nE"nE" pƖ>nq*N1` NEZREQ>n8nޚefy#hkG4CC-geNx1$GYn_nVnE#n>nA=Eh"jE1kE"nGYnr&e8nޜE"^E"oG CXqߞZ+Co"}O"nT CX܊Du!iD"E"DF"nE"nE"nE1mE"n"dmڜE&- nE"Ahڙpmbі\|mpE n߅6gntE"h&dyN1eĤ?**CnğEnE3AMneZ]kUgn|plT"ne݊背HC}W"nT"mŔE$O hVnE(nm@nKS]'FK!ncݞnE"EΛԺ|; o"^E"{En&"hߜC^E"xE`ةV|ї\|mpE:nߊG nBF!e~v$nĘEnE3laE9APK%nE"nE"lr"nEpBN`=phxlHGK4+G(N\Fx$ )nX]׳;4'EbܘE"d<45oVc$nğE+nE3mE"DVnE#nmnE"}B"nT %o"^E"oG!lo1mE"nm!nޜVnE#nA"du&]" "dE(iaE9!9=EK*n8cݍnE""x"nE\nE"e7Ym'ne[S#ܟ MNÝfhDti|HN4L?e)P"g(NdCcGYn*lnuNIKM-էc݉DA"nE"nܡE"N3ON`(0E"nE"cn9lE("CGXe.nA"+nE"nǜE&FC)B>g3%N`CcC"n9cnE"nE"~nFA(}[KnA+"[ϐnTym!n$E"FC n("hA|7+0rLove\6pޏu!T_"Ԝ7LNVеCeF"nE ncݤ{E&i͡}(N+8CޜE1m͜E"ne^Twlmegn|plR"nn>g:E"}M"nT FO^E"oGMnE1jE"nFQnVnE#nE"FCVnp"jE1mE"nmqnޜVnE9neͬ6`K&n(cݍnE"Hn[O%ƍ=tnNR:x*|$ 4hE1mE"nmvnޜVnE9n5"hE N);dCeF"n c nE"aO4ʹ=EE9E"^F"rE8.y[яH=0E"nGE" #n3EnzE"(nE" nEnE"lE"#nEnE"lp4}nT$en픴"he'/՗cݞe"N3Nܐx$őN3_<=8KZmҤupA3~E$;eB[V[̉pnR|F7c݈zL3N~hqxƘ$gLD"usE$]g}E$jE(k~OT,@bݞf V.b*D{ߚez!ѺT/!Ccm_nE"eSVΑ՚bݏNV)c7>;N;TC#cm]nE"FlC nmnE"FiC nmn"he| z_̘pnC׷cW"q{^3N$x4E$QLD"usE$iE"mdE$fkCynEaݞjc14̈́7V{ c nT/eq/K}_ri*4` N[,1W4pa4~V c"c͹1N,LC[cT%ffE$hO3N:qHiНF%pE(4Vc0E j?NiCBcM\n"d n#c͉ͺ~c;{nA!6ge$Spe.讼H>涌pn:PcT&HH}qG =nA}eVpޜE1j^E"nG ne,*L>Z,+E'n:E"nD"0"n_cnE"oE"C#nwEoeJܟE"FxC nT'I%y3nCԑ7AK{ҍ@"U$@6%e pߝS.CSKH67SҤxpE"FOUԶz4{qVc b;m%n E"FzCXkdNw@HCcE1pE"FO1N0!>]AN#@hʹ]*jHR̄p?"hنVr c N%7mxn@ MeЕnE#nҝE"oE"n^nEn"dox~¼KR|yW nEUn풞E"nD"G nFEn|E"o6E"@"nccan+E"QoF"m n#EmH5Y}eni/宼{Jpn@cJ"5T*T$U""dũE(ηsoc݆qJV&[4sVc3FO n@-FO3;/2mneRGupgŨE(0e)n V)emX$ߚe/.ѺT1CcJ"5T' n"dE n@HYqJm~nE"}myn/N""dũE(gaF$Ԅ"դbݞ`"dV-?}qe\3̹pg1ԃm4X6VV c T3ŨE(ԁ"4%V c-FO3;]ŨE(0T$Y}eB[﮼[w)paE"JZŨE(3V(i.I3Nwx5,$V?ebs+p"d"d3t5Jm~nE";E"FO1npNݥ~E nyHYFO nJ"5MHYqJH3NxErHnPn8E"FHC.fԴ"hmnE"cU҇- ըcݍFNC)k̈́N !C cT'73w} pE"u#nT"FDC.FGC/m_E$5/eA V'0E"XE"ln"nE neO鳮DTL&T'PǬnԁ]4-zEMmn"hA lc"h*E3BԍuKRNvgC}!n+cݕnE"Emn@ӞeꕷF]C)Q;Z]NvgC}'nE"nE"c"nưi*7` N?Ԕ4!L -n@Xez"kfϷNlC1*E&tя@8+EnE"nGpEMIJn$TQ`k "h=E W"c*_}xpSCҎDܚwB GnUN*nn6m n}j/Fn n)E m!nE"G ;nD n"hY֖]qյc݉DF"nE"lgE(nğE)nE3nޜ^nEn)xK؃N|e/"nWEOnE"nE"y#nEnJcݷT$f͘bUwE;gKe}tnmݏnҍL=mnT\s9x}tE"AYnW!FnjE$*.4E_Vlc3BԊQrK˰I^ҍi~$"he~M@"B۾pbD1ٔehNѷC1 c3NxVc3B蕔K :ҍi$qTb,}ue(Q6BpbD xt>fP9`nE"E"j$BrA#hipeRɕpGE"V+B&NM :CcT=p)ߚeѺ}uuE"AYnL oTmDXD}uS^pfݞfT>7<@}(uE"AYnM nInZbmV-B~NgCcT07XS1Դ4oBV^ c3x]3N.xl$lN~wh͈XHؼ *=p닓1is4͏V c&iJmҏnT6D"/S6}vmE"ؼ(Ie݋h&ZuV*.m}%veCy*ڌhpnlзcR1A^n"jE"LEnF#hiպg5eYpeԭȮYDqpnZrYFC1NѹwJ4qo_N5*h}UŪHؼʷpӱMYn$%׆`B#dݏNu"TJKTw 9SQ%V})wi*<"` N|&:4vpFR5VB~ N%xCcA3q""hԘT3~;lE"}T=E$LՊ!MױM5/n$7Ւz`c;nE"A,C[EZ2ŨE(}F8oL1|ܘD"})s V}xHCkݯ^mʏne6E̖p`T4f%IWEKe )}yi*0r6` N3Cԃ4XpFCXBͧ>aNYCcE\n"jE&aJmnTU$V>rE$sؼvSL՞jݞ`ӍitnܚD"HʜE&,>unp"jiڌQo"}L"nT jlE(nu!iD"E"DF"nE"lnE(nğE%nE3FvO}M"nT FqO^E"o6nޜE1jE"nF nVnE#nA'jĜE(}B"nT o"^E"oG nE1mE"n*nޜVnE#n"du hD"VE(nF"nE"lWE(nĘE*nE3mPE(}B"nT o"^E"oG nG^nbP n"jE"DĒEnӜE3Na~oA`/0E"CDE" "nEnE"n"ng'"ie8OܝE"FCB"E>9omYnܖE"e@z4rEhBE0Վcݧf?+5$f%Y}@p>`neط n%ԺpiE(>˜E&>E&7;{n;{n^n^n"h I+H?}qM `5DvxE"FnV_,#aE#-eͦ__leK ܞE"FC]F"EfmYn$E"FC0FC oM`;Dt"oO (E 0cm!nE"N- n߼i(E nܕD"|E"FC(*eiҕI;+EpE"nJ*_1%nDu$m")KN{Cb@"nIE'nE"9nDpV\E,x: t91)nъGn>`5DvV\'2`"oOZOE ~m*nE"N#]>N n߼@E nܕD"|E"FC(N>ax!$eH| ̻phE1hSE"n]nS mOԘY&K&n혜E"nE"cnHPPm!nhhFn n+0E m#nE"G oD nO#h_OYԼse0;p4aD}phu$l"NPaCbA"n1cnE"n;5e`4DNm3 n߼`E e!4ܟE"N~1A nߴ>"h=ӜE gW#m)npM0e.d6pq4͔$Vc$nĚEnܜE3u`E#xxE"FnV]&kaE#-Kn>Nؙk_ѐ\|mpE neܞE"NK} nߴ>"hoeBܟE"FCnL#h0"hE$fDKoN켭CޜVnE#n"du!iD";E"DB"oE"n5yA$qN"nEn0E"nE"Sp"n]EpE"n"nM)˹n$ `Nb xEO)N8lx[h\$ ncդ铷E&g@1QN[hCcLeb"ߕpԳ>6i46QNVc5g6N,CYcG!k"hMi5n$ \!`zcS(Nxc$o1mE"nE"oaE#*eN°fI|bpE5nE"nD""nE]nE"o9#nxE"An."omE&N&qxn(5$ NMn "j԰nV4ͩOVcf."omE&nIntE"hYiNIC/cZ2dnԜG"DnedîÿpNGn"j ::}4V\V c=DnE"naE#$CGepxE"A$ 3iܴ}q."omE&N/o'x"M($E"jaE#+C~{eQ.pxE"Aj."omE&NMxWAD$E"naE#:o"nE`$D"nE"ڬk]͜E"nM"'nd`"MnɜE"QnP&"~fe'EnE",E"U"nγfnE"nVE"nE&n)Mnd5"jfqE"n#ؓOJ"nѯE4nENnƜE"nD""nEonE"nE"D@"nE(nE"nE"oF"nE nE"nE"JL"nEPD"nE"E"nEh)"nD$쇝C"KoE$# lGOh6#nD$뇝C"Kh&EB2~Ud1nbV$EÈK"{fE֚5inlRQh"n]$sC"cvjE4g;in\ďh:nzE$iC"tEiB*8inh_Qhއ6#nNWC$K"rE`4>rY_`K>n{D$C"osE-M=o.E$C"fZE$Zinpďh"n_$؆C"[Ex[s `ʪmnY(wO"%XvE๹ar,hثz"nð_$ڇC"0YE` o}Qh퀤z"n~D$ՇC"WEn%WU|h6#nΰ_$BׇO"TnEKioyQhn6#nZD"n표E"nE/~E"nE/~~E"nE'~E"nE'~E"nE'~E"nE'~E"nE/~E"nE'~E"nE/~푒E"nE7nE"nE7n햓E"nE"n튓E"nE"nE"nE"~ڌE"nE'njE"nE'nE"nE"nBE"nE"~7nE"nE"nE#n94nE'nE"n-E n홼E"n*E'n}E"n+E/nRE"n$E/nE"n$E'nƽE"nn$E'nE"nn$E#n[94n$E'n%E"jn%E'nzE"jn!E'n#E"jn]E'nRE"jnYE'n E"jnUE'nݸE"jnQE'nE"jnME'n{E"jnIE'nESe(o5Om1"nD!QF"eHE,./nH1mđ"n$E!cF"czEŜ2oUI_v6#nNDF&T"]} E-7l^e#m*D&nԘA$=QOQint;d2}'nE@!`-F"F1Ej! *n!ki}-$nC1¿V"AEk% hji}j$nWC1¿V"|AE-%nhui}헬$nC$C"\^EͿNnth"nE@$-C"<_4E*nwhЮ"n9E$2QC"\HEhPwlhA&nǘA$NC"]EVjj0v&h"nx5l"n5n"n05l"n5l"n5l"n䜑5l"n䜿5l"nS:l"nw: l"n:l("n:lT"n䜕:l@"n䜿:.li"nt;nh"n;$l"n/;>l"n;6l"n;Ol"n䜉;Hl"n8ol"n8gl"n8~l<"n8wl("n䜝8mT"nK9m@"nv9ml"n 9mi"n.9n"n9m"n9m"n䜯9m"nd>m"n>m"n>m*"n䜆>Bo"n䜚>m"nO?m8"nc?m$"n?mP"n?m|"n??mh"n?m"n?m"n䜶? m"nX"n✬ ~k5"nrh7"n5h6"nyk i"nn p"n1h T"nsm "nh "n"n "n✴h "nQ#n "n"nE#nD"nE"nE"nE"lE"nE nF"nE"nE"nE"mE"nE#nG"nE"nE"nE"lE"nE nD"nE"nE"nE"lE"nE nF"nE"nE"nE"oҾEn֜E!+A"LEn6ng"l̾E"nE nD"%LEnnVg"kE"n֜E#G"ELEQnn)g"mOE"n'֜E#nG"nE֭nnf"jE"nלE$,B"ME@n5nf eeE"n֜E/8D"MEn6nhg"lE"nלE&u@"ME`nnf"g턿E"nnמE)D"nE"nnVf"mE"n֜E#D"MMEnE"nE"oE"nלE!iA"JE7nng oE"n֜E#G"vME%nUna"oE"nE#G"JEgnng"oE"nМE#nG"nEҬn/na"j퀸E"nhМE$+B"LEQnna"mE"nМE'D"nE"nnef"mE"nFОE'C"LEtlng"oE"nלE!iA"$JEnE"nE"o6E"n МE!+A"LEQnnxa"oE"nE#G"LEtn6n^f"oE"nE#G"JEnnn`"hE"n֞E#VG"LEҬn/n`"j߹G"nќE#nG"nE"nE"nE"oE"nE#nG"nEo nE"lE"nE&n@"nE^nn*l"j3G"n ݜE#JG"DEnn$o"j/E"nޜE#=G"EEn n#n"oE"n؜E#;D"BEnnli kE"nڜE rF"@E{nnE{_"x]E "'nE(g﫜;$lC1zl ncG}͞"hE'﫜+%lC{1z$ ncG}ꅞ"flE(﫜O"lE1z n5G}dE"nTE/Q&n+ðE;A mYE5nEW+%nWLgՙ|"VMG%|n}t쫜E#n~LC7D#nE@m}wP#o^̀Ol#DVUG8圙d\}}P﫜Q&>nͨO3uM"WTUG5"n|~(nES1Q"nE}dМ"nE(z퉏#nFD.i"}7FBoVR푥#n͕N1"WEp}"etE(b[ n(͕Nn1\!ZWEʶ1՟j|QO+m;Nvܚl!TAUG՟A6eW'oCc1zt"T5ElTEL)&n%D㏠"mTEϵŜwe~G#VnbNӏUᐴ"UEEM휝bE(G쎧C!mdόFܐt#ncD}뵝m[~7'q.oϦICM uUTUG PᕝNbytРO"mF1#RDl}b|E(쮠!.oȜD#R-D}Ed|t|Nwt!m&IsjKd!TF=ky^'T'FlD@Cx#nF蕟"kHy/'mȿEˎ1횛#S:D2dPhxl nA*L"{nE)`ݜ"fE[@퇜6%nBEk"n]Eڜ&"iE@Ϝ$nC5֛k"nEi뽜"f'ElO*FnvLˏl#4n?DNW"f.EgE*lo~M#$nGN"fEQMoe*lFEa \nG州"nE9 'K"l~L =UY"=2Vݾ P"NXԐ'"3"/h<ޥ/g"ߎ"|?"h$A="n&ZW2i[2[ 4nޟZ u ؙ*$ nm)C®\$f-߶;w[߭ZrO$wͥ*qWpJ+#?r"ޒ4h<)T+1c qN.K/3MܣUW$N "\U|P[a*"ّt*w&,K "^+m6 ck6۝?"92J/$W߅ g4܀")G> +4ElY7ru"9N&uM($J"#qVcp{\"&@[>*X"sr .@$/n*"#٣&A'6g%J("1"!ͬ2N)3z>ݎH?"8ޥtsj$@$Ei*D8݀c8tZ#EqEqkkn5m&R4؃z6T`ڤw/#g A%uM(a)@V0H(vW0f&O)"{%qj$Iۥ1g4ԇ$Mss^l<[sA6**te I&X'k]۠3c"EO MY`45\2)`2[iرpC%4g2oZߗ|ezXLZԇT76kuLuedYf(ؒ J9ix& M-C/qԚz]&O\A'Q(I+2N oQn6EX?C.{6.In T\Q1R\/nLP#eX6gn d=tIq]Wn :/S)@Y۰2In R-v+Hnڬ4j:ݿ3d+xn۳*d:ճ3Ngnrt'`[QXVn`۷WW=A?}Mn/r[ݱ`/#fnRX}[!޽n|rn#{\f_+(en߸O?'CvnM**w xĮ#Ens#a(qZHn4U,z9޳|Ǥ*rnc n45Z) Gn޶O cZ=ߤ}n(Hl'oQn1W@\$q<"cnP3Xg'ޞ@n+U&6Zݛ!ns o-ټ=ԅIn!z\$HY pnT&X_qn$Sn®&.a$ԓ?I*ܵ"znmsG7[onť>sxZ|S9pDn){6N;Swh4a#'z.i7q@#X۽wo$H Er)jZ*LZw;Epق2u!qA9EVtsO%ͨXEw^wM޿qw/E{)+M)C w>ڭEgՙ.[WqD ߗ+l&El&p'_-ھE[)*cZ2p_߮4 ܲE(q&۶IZ/H"X2g/̨)!?V7"gEf*/X:M'Ec4Z(ܕe|@)EIڳk l=7R[EQi ޙ|a޵?OVEq%"Eª[:ܾ$hEk6 z:W%E%5a'e4+m:T*5ܑ1[ [$ K<7SxsU9ض!N[&L1j!GƨJw]0a\ܹ6`ZՎ-xRY¨0cpe:7K 1Q;ܧv؞ti*wU՚2p rOI=r8ܺ7lNį&k` Sq- tx- X,T&5X![VRW'աkZO"T -g'o,-j(t"<5A(/W؃E6"=V%#*Q,Q6K@ Pkk$N2xՄ2J-A\ @nu7Ճ2H_0zn 4ݟ"]uZ:E(},ۮuuH*ùEc$V1V$Qn1G@#K,MnK8Arm^!xn ]a- $cnݗa=v'O>*n1K 6G*0Nn&P(ߑ}v7j"1Pn̬tuvܷ2Zven[!eߖwJXnnذ'e7V .S}P7vI#}TXͬX:Լ/n߆|G"rS\٘n"խ(m$dn4XZ|x92sEn4E rE{-&nރwپ q[a,JnޑvRJ;1{/ns]D(ٞn'G'EKZSWsF t&Ec$Kn[t\P hnsԮ+t8(n!D/@/ FvIn O(G`/I+"Vخm/(@)F6Væ#N +Q<`7c EdC"7a/!E;ݐ)wL[?T!Eo WEzpa/(CEv,N Q#)G&V4@ emsA&L1Mn1G@)G6"+N- A$Qn$&g {=Vn!w+!Z>5_2jn!Sd,qC/4T/*A!W햬R٭c+t?©"G/!v7w%**F =S 0"R=I$퀫!k!7M #W5퍨ua( +,Q)G9G ŮT)(d>6A) #e,f+S/<"(G C ve).F,q[ԕC;ޙC!f[v owWw82U T6M(P^2fvlj)5p/mì3nZ' Ī$d%S#)v4m,0O }n&G,A(CP MXٽ#M*L]q+sٝv6q= Qn4P^'Q'ا1f< wr*TV5U7n#,A)GG3M6[ 0Nn+A$An1K+qEQVG a&I*"C+AEg *In E4o+upؒN c%ّcq@'C,s8"u/C^i8ړX:+W VEV|a[jԇ$)Eu+Fc=)[:%sX6R$Qnj'A_$A:ـn5Hہ+a\/S#./팪i)6Z vn(ݱ Qn)N K+i ŭ*v|E&|W*T[0QY5x"7/O 6Ea?|V[,Knt{۲+f[ƥ#L'&d!D$Ԗ$'e$J>5l Ԅ l:۲Wp' S 2c E* hԎ}J94m-|3`+A- N# U_)mڬއvPxpc!nzn-J.m'A#O$Z%ܵ+J| ,T|[6vA))TԿ4PǯR$si$,Q;26 w$ESX'i*0J;t6sz2[\ENV۶5N="L+Vn.ccNn ٢wn4ԛQ"/Ů*@ t[ ܖ=F=$xn7V}O#P/!p\[!գ|enQ n/>-h!WEDԡ4V^(p]Eg&c\EXm8#K?D$k rF? 8#k5l P*M^&k"/W;/xER>3V(ܻi=I'sC4"Z ͬ uEk 3A"ڄD-W:E-K*$g3FZ+a#q'AvWqXvv ,Fڜ=U!7v>M_ߞ1AސU:#g}N 1+ޛvA1o/6O4 F<-q8-Jt!?)atx*۽5PVtA=|uͤX^uIu>zz/-T\Ek k! f`.QĭN:tNphnߺ1hqc .i' t|VXޑMqr0d-PnuCԵuCQ9tTZEG[=iph^uR7d(x=rէr!w/(w/ZR!e*޳+eն=w%vZZ݇!d( R4؟?S 0V+=I>2F d-ۦa`՛2a=I;/AEI6C !G\tz^E;a8C&wxE;?`7V6ٵrS7݃"_0I_î$h&޿!l7,";!v L$)"D;a#K"uf-t!+G-"/Է!uW.6|"ո"7 Lޝ$P(!@4r"*6V(=U3n:"_݇e 2K"1jXp-,n*ޠs"(o!"6h0"[G&0x`0"Z*R6َ/m"";6AVwqj"X$_خr "6!Z8)d,"VtY'M:ܝs."%4x )MV߳}u^"2QG1"4c+ X&g#c-p߂g&Q]!e[&tXtU *wk*0a/zYܑjx',/<{ۥ AV"OԟN+۰"u,l>5^uN"'$j=U8I%m?o zL!5u[)H]5k4ۄ)U JcWr5T 3Zݧd s'594[[jǩrq2R޳c;F87O j4ؑ!k K-5j$w}O_qG"R`,nqz\O/ۢrd]G/շ'dԢ5W KL]*wǮEk PE`3GMǮEv's"+L RG> Q,Ea7M7P,V,Nn*MM Pn [F$SrpJ"ٗ\oԜD&nC?mF$gu!nD#hH3dP0`@"`E!|Y'lA"oD0|G#sG#sE0jM!nD sX'kDNT3~t$Wfz] v] mHT7b˗s>NˉNX*N+fWbrԞG2|me'gU:N:|mCftu@fe%L+|mMfL+N:sL0G gtuOl@+gԟWfvtqY&oe%\+gtqY+k\+gŊnK?lD#LF,`D*cL*nC"f@"|mE sE'|mMW6fD?fD0W~|mE#LE#E |m G$j&mLE UŊh]?e]*m4\+kM:vM:f]:g@ vU+nL"lL2jY&oE'`G hC&mէE"o*R1M$QMԮu@͵)63G@e#lE"G}Y!ZqW̮#VՐwՖ}"bw@ڤE"og( U P3XK62M5N 0 P7IZe `E(5Nt@ڬE"NoE"nNo@5WV#`R1KD"#6GnE,ã'q QnԘD,`㕝E( Pkr*N@5j,G1M7GL }}5M+Q}nE(7Aà*N@*L5G<0P)Fūk^ĜE*nE"4K#V8$N* 7Q=,L,E VK ,N)7Cr\Ĳu"~[= Le#mqD"nE!oF,{D,iL*lX0hY?kWNT%|m=Q?dtUO*gԟM?fG#kE(iL?gL?fL-fM?nślE TM%mM*nX'N_i@%gB'gA%fC+g@"gB&gB2FL)kL+fC*f@%ge!sC7*C7*C7*C7*@%|B ZG0gWbjL'lA%`FrԜW*kŋNe#`Ԝ]$l@'o@`e"8F#_tITRj@%m!+iX>VٞM -G*sM*fX'gG gM*lG ltmW~g]*nC2o@(m4e"D dŚm@(|mtB!sB!sB&fE eSw̜"nEf"nEW 퀜"nEK횜E"nEWڜ}"nE#/퇜6"nENԜ"nEK횜E"nE_k"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nD"nq"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nE"nlSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP lSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetfSystem.Drawing.Icon System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089mSystem.Globalization.CultureInfo mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3ảcBjCQ+:2SQ}3Bt9%Pi Af= $this.SnapToGrid&$this.TrayLargeIcon$this.Icon$this.Locked $this.DrawGrid progressBar1.Modifiers "$this.Localizabled $this.Languagef $this.GridSizeD $this.TrayHeight&progressBar1.Locked@QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.IconIconDataIconSizeSystem.Drawing.Size System.Drawing.Sizewidthheight ( @AISystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089System.CodeDom.MemberAttributesvalue__`B System.Globalization.CultureInfo m_isReadOnlycompareInfotextInfonumInfodateTimeInfocalendar m_dataItem cultureIDm_namem_useUserOverride System.Globalization.CompareInfoSystem.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfo&System.Globalization.GregorianCalendar System.Globalization.CompareInfom_name win32LCIDculture m_SortVersion System.Globalization.SortVersion System.Globalization.TextInfom_listSeparatorm_isReadOnly m_cultureNamecustomCultureNamem_nDataItemm_useUserOverride m_win32LangID, %System.Globalization.NumberFormatInfo"numberGroupSizescurrencyGroupSizespercentGroupSizespositiveSignnegativeSignnumberDecimalSeparatornumberGroupSeparatorcurrencyGroupSeparatorcurrencyDecimalSeparatorcurrencySymbolansiCurrencySymbol nanSymbolpositiveInfinitySymbolnegativeInfinitySymbolpercentDecimalSeparatorpercentGroupSeparator percentSymbolperMilleSymbolnativeDigits m_dataItemnumberDecimalDigitscurrencyDecimalDigitscurrencyPositivePatterncurrencyNegativePatternnumberNegativePatternpercentPositivePatternpercentNegativePatternpercentDecimalDigitsdigitSubstitution isReadOnlym_useUserOverride m_isInvariantvalidForParseAsNumbervalidForParseAsCurrency +-. ¤ NaNInfinity -Infinity %‰ 'System.Globalization.DateTimeFormatInfo+m_nameamDesignatorpmDesignator dateSeparatorgeneralShortTimePatterngeneralLongTimePattern timeSeparatormonthDayPatterndateTimeOffsetPatterncalendarfirstDayOfWeekcalendarWeekRulefullDateTimePatternabbreviatedDayNamesm_superShortDayNamesdayNamesabbreviatedMonthNames monthNamesgenitiveMonthNamesm_genitiveAbbreviatedMonthNamesleapYearMonthNameslongDatePatternshortDatePatternyearMonthPatternlongTimePatternshortTimePatternallYearMonthPatternsallShortDatePatternsallLongDatePatternsallShortTimePatternsallLongTimePatterns m_eraNamesm_abbrevEraNamesm_abbrevEnglishEraNamesoptionalCalendarsm_isReadOnlyformatFlags CultureIDm_useUserOverridebUseCalendarInfo nDataItemm_isDefaultCalendarm_dateWords&System.Globalization.GregorianCalendar(System.Globalization.DateTimeFormatFlags AMPM/ : ! " #dddd, dd MMMM yyyy$ MM/dd/yyyy% yyyy MMMM&HH:mm:ss'HH:mm ( ) * + -(System.Globalization.DateTimeFormatFlagsvalue__ &System.Globalization.GregorianCalendarm_typem_currentEraValuetwoDigitYearMaxCalendar+m_currentEraValueCalendar+m_isReadOnlyCalendar+twoDigitYearMax+System.Globalization.GregorianCalendarTypes+System.Globalization.GregorianCalendarTypesvalue__ 00112233445566778899!:Sun;MonThu?Fri@Sat" AJanBFebCMarDAprEMayFJunGJulHAugISepJOctKNovLDec ( %) $P yyyy-MM-dd* #+ 'Shh:mm ttTH:mmUh:mm tt, &-CQSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.SizewidthheightPSessionId"nEQ*;FS GK '@EqualsHI9@tHHGetValueOrDefault.@:χٔp~Q9;RNFget_HasValuexjVp $ν|*ƇGF0FؘiD[\"kqCy!Ib%@@QZ^&Ƕ]/SD!7Ç ZEogL*B9q"am8D꾤K`Kp~('09|eVD")*C#9Y[e}]O~o CN~S5:*ӆToStringget_ValueBDH/SdZRfhn M"v33m M")avX0 0*H UEx}tJ@]GetHashCode&RSDS8?exEG1LumenMind.pdbh~ p_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO?DVarFileInfo$TranslationXStringFileInfo4000004b0MCommentsLumenMind randomize timing between stimuli to prevent rhythm-based guessing.4 CompanyNameLumenMindHFileDescriptionLumenMind Voxel0FileVersion2.4.8.1ZLZ'!,GQpпla5R,#SkA )>O{@$/ g7}kV[VqXexN%{s&wȔdgyB;[K ܮ 0x~[bX5ѶUbn[6;Rw\eR -j؈BUmWZL hEђma*޶oaU ^8(0JpB=%Ou +C`[aRY8㪨BA0Mbk:Lé{+%Y1Uo l >\jK8y;&r%( !땡DQmnߓ@Y~K}i,g{;7:H9$S?@+XKUJЁ!YF+mmz*LK'p tﱇdMItn:` 3 o_aX ;uࠈb-e:fpC9"jdѴgX?' Cx;leRuکȒH࣒'tŜ%/uo&04huHb8L%vfZ??viNtRw/Z](v=kP":z z `7xcutP:h=ǹ |m\yiwtI_XIGY|5}Sw0L<6.S6)Y%XL>T8 VTCSscwS{Rk 惣7NX1G|DmƢ㫰w]qr\(Y?zC'FD}R#OpjZx>HugDV2AH*AQp oD@qU鑊Vx*bVbes$\g_̮Ia #C˳\[˷\OReN*(P2&\[8^`S,DX)Ddeo N>o2ҾC:Jia@gΙKp "M7ǤՍЊp#B$%:%!cޣf;)üܗABɅ*ME3}E6`$TGQXb$q5u PBؘ\Dt=$1ľMjS3iF9Fx\^&Ls>[5\`Z!jukD.0~EAdCᖾ:Aإ:󀞏FWC1<[?rΟ]UL0`{ _܍!,wNwS&Դ ihow48Y+3"W¹7w8qF0ã܌|$ZX}ceom|<7yYy#"! 0TxXWtE Biگ@ Zlplq!N 0G2qa| 풤Pij:V y^ g+Q޻uAVKhq㰦צ*+`\ßF$Ҕ-xVöw7ȷJ?~iJ'" KJo hTuNc>z]L\u $@@?ZqB7 M4CVC8͙d_W{A(gt=o1IKL)4x#J0rgpcYX')q3.qnȓN70Ĭq/),]w\k4ŤPYqO1hh>B DW2C*޳ Ȳ_z؛ӅJd>pbYt28JB? 1Q,1LIïVfpXO,GbǸ}۳{u?|'fmh͍ώF GB7ޓkS{|뿯N9p2pDГl+H:tk00QRJǦ.Se#c&MQU׭ =EmiUh۹J.M>/ LrUmf%?yDMr@.&`PDwѝu;6i lpTv|B7bV[Z틔D{e|p:S6 >mتRC?k'In!(IMTګ#GաF^beb5X4K`#ЋAaV ,wݯ&k$Qҕ0ϾuA1&I{J")EQ+z |ň9Eέ|]^P_KcZ{i})knQ,"<~p;՛8/8c5ɊX@w- x@qKޗ1N>転1oD V]tp3"MȄSݘJx-2>]]O{T)3Cxõ&㮨V5FLAnnf"\xT%ҶwNt<"Η|0_ n5_5<#۠Τ`e^X'2)ˌr_b@ ,v0hXNU8F xwyud%ܢ ?-rOHhQq6]m|`fdgl*-sJ˒%Z6H:~%[:VX&Z FVfyxf'l[~BC>#4;Zi,";r2$؊V.-n?BuI0Z SfK2[RL018t~ /Y;-ϐpmɌseO4$^Y=ia~ڮ!>qȺ zuǫ2z+ޮ[}󉟝-!G_C#L`%k_2dJ.iG2r)uq(y27UmV LɶT06yD]xѭkр\$?HرaQ_Y #5.^.sϮ;PXO.(\cmg:eqO7l6a>N:_oH&q%^d۬Q*Ni(9S2A;cؖ'! a;C#\A+c0ӆβmG"&",J^Ơ)ť2O/:+&g'KE=\HNxA\sMB;#uyB'}#努۬M|q$Z@2&MwOfZG1C5sl%nJxظ+"Om*uz HQR?k7<5DyBKzu@o.?at vd+;چ@/*kPӬG8d®M+`|FڦYǿj>J)V`V0X1)`N/ >PGk&lMjmC ;fQE\\)NEK" sُ3aȦQr 2/qo +ZC4JFZU%KQ'YYeFsXz.[۩W7BmNS6B*!1_1mS+fǻA4{6B m\mf&4l#?WMNEW`>ML31^m'mIbSBI`zl.$?7/]6/WyHlfiI-g:4mBAmuv(@SC*3ӭ)YcRJ7s[XhβN)XONFn*CHU%w6uoS i?qܡeu !`cM[M |&ꊒhj5ufVMUTZ<#m2oZ+sK#EuA2'#6]讚q4uZzQt)pOC*,=Jn/pX8ǜJD0%'8+ d[ٲg*vØh-Wov;~o|(U,-4}I=|v;y1 +sB)Dvqo3P'k~{QPK 1C{҂7+cnrems&$u`ܬ(~0nTC$l5 oHke0]8/N}Wi|){*X@T>ilf14{Qv;uhnPuśIc+^+ɆTzF9rt~í=ɠ>GU,w|ǖlhp$*+8/KY'f\76Rn8ɞgMAz-_[_'T[MIl-=EH[UFDi~3S78:r!\f$lyz(v9{i#U,.t(-tcPyz1ݤ|˨ʟ {gw@~`=KΕo5diʤ9bX{/R2=ɘ:685DɄ㿑|c? fޑ\/F}GZ_ dmTW֪}7aN-./-_%#iq0Xcѣg@VѤ󇷼(z {ε &-IF0K rI%6Aɛc-s>}1m3`C|^/blcWx'y lnCXqdЉ_ϦJB$8FCJ܋xS#e̪ |YsC.v>C5>h~J;5piUIh:b l$/ w~gprHX*ap]Utneܙl n̰Nd"a==n'J%JoR< 4ϣ5o«f>e ι5 }Abu#!?w|'8DsTtnP%£w&*6бgdr) -KQ ڂ)+0IGϼ.Oynr> 8Gb:TK4zaGr '!zvpCtɾzqM;j8TNCwԂYfHvw`N p|"O6! wOg5\-nRW1 `ryRu!'aN}*!4ţqcxquhϏ9T?=ų+I?GwHތ888˼T2NEØ+;▕*pJ Ά͖:GUGu#ƯJLR3=imLc^Vfob(LsU!rhIh~P[5PV?QWOk/ P;0JVrfqX_"xy\왵r=\Lg [(Z?AiYnv8tRZ"=x~q}uhǠ)ۿSz|%x$/~xTiҀԐTl|Jd!%z[PV|<}ǈoC+3+{qdx7 ն?Ӷ?pk+b 80D %s1N%LF:[jSOi#w`u}si GwVJI1qj𝐱gJ3/?ٓ߭)Gr97IwdWkknBAH?._L[ƺ.A;U[zw"y -/nsAw90CLx`MpgC._*vǋ(4{K&a5e ƌю*LM@0#2ftӐfoR.SETu`97mpE*+Xz+uʾ:g77V>vgݲ?I>u%4AV9'JuNc!~O( @׭Oo 5?خLiկõvN!G|dkkrfJ +ݟS;;ߌ"hj$Q',?i6]f/èCaurYmPScMJ{ce:zlğ,a Q Fc_Z`o^_8<' @aݓ ^KfAr*^!e}y2j_ }wFi,Y77S)%HZ I+; mb.M@[3F574qag-*ryy3!|:!j;:I y I ԝK7OgI:dPѡ=R {ΆK2E[)M_)6eՂ=-f/vcoh$N?_R@OqėB y\ tm;g&q&lǀL`gݩ2xkCeuv#T;se{K?(|ZA`QaW3Q$).}.<*OGܪp501HЀ/iM;1$ '}lA9IX.0V3&'h}F/nUp+ao*܉X )TU9Յѻ=,<$Sg$j5cOTyhDynh{88I=gUv+&jh蘖ob,ObZxoX}^fgQEPL-Ħ#G#6)S /ёB_Pg=W0H !ΊkDI%kGr4tYnr-+L(N pKPhƢ2|iI+#` dƻgYQw(EVB$"1ZFnёݡDSc̽!n@6^" +D3Cx/\U3M&0}3W n'y5mEiw ]@~\R!"v4߭ ɛ"*]w͞" hH$`6a\8$fo/UªhCx$MFJ%f*TE`uٜC~gm䇝C|DKZ[lNe5Cq{!R(Ar8ab~elƘJ%;JųF7v վ
L6M*='6dFMb'E'"ޭ$v uoբ5πfLAGQW)/4Ƙ :[ Wi=.F:4F#nXrrR zOtnw؈#:$LI+0k_ˬ-k͖#Nl4:@@*CJ\DeuFQPZ#;I/2+>ٶ @io^M540?p7mvk}W^iyPtߨ;No#@Yqߏheh%(:Lڔ-74F3.DeF6dl{k03X5`]zQ򷙣f ؟H 0\ۆ:MYI"m=e^|clёX01^f 3k)I[Ѐ~"lu>IӁId^~(ƅ JVTjQ:i(>N!,⍲`sS 3WU*pZ(Yns RnO3j$Ee{ɩ@sebLNR䬡<6f.UClgg"m(pfvQa,'o4Yp%4ɋıŷr6Kq;8Jz'|]$'x4J/oyj,j~5ݻb:meWP;KLQ>'?yA6bk˼="p'E0E6"*Cг~=dj[inG,T4đ,ޞs[v1B[CCOcR(~~v~8}L?$mr;ЇĎ#<]ג{hm.lѸZdWjRƂ+bIӀWcA{8vf'BE?vSݼ" !H8h'jL}EߗU^gInq=mGUm;?A "X3Gmw=f տ+YJxSݨ}}Kݧ\Nt.|ҼЂ MHW5P=6h:Uw.^?ݯИ.զb2Zn9V#MnJ|v)[iIH,OʐȻbx66^|g:lW}:gI`A:X@@/G%ĝ2=)fZ l;7FΗƷ.U{&8> Rٴ5f|Ό7*p8Y6涼 D=Et:|0N~\%r~B2rp|Qr{,jK"QjIa[qoI{68PZ[b+_!4eoY|q_iU4ygjg!~-M/ѴpXD /{`u͙OߴsMRQg:~0&1Cap_y{XbDŕHQluf))5.HH۬͞Fx1r rrl6t"y(%%~u"]+?@'vz`-$:IfB]K%Ty[_/OĤiS^5nҒ]S˞i]k"G]w@P fMnaAJB KvE zjkL@Rvz<)&suĪ6aqpDj.xFVݗ=@x: ɴXl9Ĩy:z٢W40޽du1J6pװ1X"'O)o EZ;U^Ch~XL6ld} TO#2}'4nMDmz@nscK4 Ћ]D}Sy8zed+?ê ۔մ:bhdL/);L?SwD꟮9D+\)˚a>B]>H#6^dנu!xPׇiJaRB&d/)y/IxB9tEEyv5#QH&Ww&jPiJADI0TdBN)،e7Npd&C*Cp%_,y8ПW06^619Orrƞy'"j^>[HbPv56ط\{q3 $˷9 dFtq5w ھEvm.ct] ' Y\W!]qPN/YZFmMB"jסՄRƊZuNYx`onHX*vʬo!ƅ_\;iu7~2/+'$0@\UI T#vՎ]K$q-D݆&rphrVj̊wpzatWݗOh#˕'$5wQGb xѶ+8И٧#W M2Bb9g=Bo#3@tR P @o"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790934143836,"unified_at":"2026-10-02T09:42:23.836Z","metadata":{"hashes":{"sha256":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522","sha1":"edaae8e1af00add763d33e28be29ea85bf08b470","md5":"2039e2b2a542b216d3e2fa979c47340e","sha512":"2ec5bd8a55be9cc9b743b98fecf04d0712035447c4e770f0c5be1b5c9f5098786d21e4d1f30f17a82c4d61f84a6a80aef9c820a5d923f40381b41a69a69f7995","ssdeep":"24576:gNSBcKr6eRt4Z64Cj8R45yT/bG3K6tYq/XA:gNSBcKr6eRt4Z6488RznaXY4XA","ssdeep_chunks":["24576:gNSBcKr","24576:NSBcKr6","24576:SBcKr6e","24576:BcKr6eR","24576:cKr6eRt","24576:Kr6eRt4","24576:r6eRt4Z","24576:6eRt4Z6","24576:eRt4Z64","24576:Rt4Z64C","24576:t4Z64Cj","24576:4Z64Cj8","24576:Z64Cj8R","24576:64Cj8R4","24576:4Cj8R45","24576:Cj8R45y","24576:j8R45yT","24576:8R45yT/","24576:R45yT/b","24576:45yT/bG","24576:5yT/bG3","24576:yT/bG3K","24576:T/bG3K6","24576:/bG3K6t","24576:bG3K6tY","24576:G3K6tYq","24576:3K6tYq/","24576:K6tYq/X","24576:6tYq/XA","49152:gNSBcKr","49152:NSBcKr6","49152:SBcKr6e","49152:BcKr6eR","49152:cKr6eRt","49152:Kr6eRt4","49152:r6eRt4Z","49152:6eRt4Z6","49152:eRt4Z64","49152:Rt4Z64C","49152:t4Z64Cj","49152:4Z64Cj8","49152:Z64Cj8R","49152:64Cj8R4","49152:4Cj8R45","49152:Cj8R45y","49152:j8R45yT","49152:8R45yT/","49152:R45yT/b","49152:45yT/bG","49152:5yT/bG3","49152:yT/bG3K","49152:T/bG3K6","49152:/bG3K6t","49152:bG3K6tY","49152:G3K6tYq","49152:3K6tYq/","49152:K6tYq/X","49152:6tYq/XA","24576:Rt4Z648","24576:t4Z6488","24576:4Z6488R","24576:Z6488Rz","24576:6488Rzn","24576:488Rzna","24576:88RznaX","24576:8RznaXY","24576:RznaXY4","24576:znaXY4X","24576:naXY4XA"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":896512,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1762561332000,"last_seen":1762774387000,"last_multi_scan":1762774387000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","keylogger","agenttesla"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":150,"suspicious_count":9,"malicious_count":4,"total":163},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Formbook.X2183","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.Noon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Kryptik.locuw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Tedy.14952","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_AgentTesla_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AOVG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Loader.y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 005ce3fd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.MVH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.MSIL.AgentTesla.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_55.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Able to perform reflective code loading"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to perform reflective code loading","description":"Found string \"at System.Reflection.Assembly.Load(Byte[])\" (Indicator: \"assembly.load\"; Source: \"00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\")\n Found string \"at System.Reflection.Assembly.Load(Byte[] rawAssembly)\" (Indicator: \"assembly.load\"; Source: \"00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000000.220399.04C10000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\")\n Found string \"lection.Assembly.Load(Byte[] rawAssembly)\" (Indicator: \"assembly.load\"; Source: \"00000000-00006644.00000000.220399.04C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":3,"id":"string-678","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"LoadResource with parameter {'hModule': '118095873', 'hResInfo': '118097120'}\" (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"LoadResource with parameter {'hModule': '118095873', 'hResInfo': '118097152'}\" (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"LoadResource with parameter {'hModule': '118095873', 'hResInfo': '118097168'}\" (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"LoadResource with parameter {'hModule': '118095873', 'hResInfo': '118097136'}\" (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load module (Dotnet string)","description":"Observed string: \"at System.Reflection.Assembly.Load(Byte[])\" (Indicator: \"Assembly.Load\") in Source: 00000000-00006644.00000000.220399.02B70000.00000004.mdmp\n 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\n Observed string: \"at System.Reflection.Assembly.Load(Byte[] rawAssembly)\" (Indicator: \"Assembly.Load\") in Source: 00000000-00006644.00000000.220399.02B70000.00000004.mdmp\n 00000000-00006644.00000000.220399.04C10000.00000004.mdmp\n 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\n Observed string: \"lection.Assembly.Load(Byte[] rawAssembly)\" (Indicator: \"Assembly.Load\") in Source: 00000000-00006644.00000000.220399.04C10000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006644.00000000.220399.02B70000.00000004.mdmp\n 00000000-00006644.00000001.220629.02B70000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe has big resource with name: \"TetraSite.demandflatteningrules\" size: \"256219\" and abnormal entropy:\"6.953143717466565\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006644.00000000.220399.04C10000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007024]\n Process \"WerFault.exe\" [UID: 00000000-00006676]\n Process \"WerFault.exe\" [UID: 00000000-00001440]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match – Encryption algorithm\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Able to perform cryptographic operations\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006644-00000C2B-2445370787\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006644-00000C2B-2445371229\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006644.00000000.220399.02B70000.00000004.mdmp, 00000000-00006644.00000001.220629.02B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"IsWow64Process\" with parameter \"6644\" - (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030 (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00006644.00000001.220629.00432000.00000002.mdmp\n 00000000-00006644.00000001.220629.05C10000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" queries volume information of \"C:\\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" at 00000000-00006644-00000C17-2445539149\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00006644-00000C17-2445701544\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00006644-00000C17-2445812984\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00000000-00006644-00000C17-2445831294","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006644.00000001.220629.00432000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006644.00000001.220629.00432000.00000002.mdmp, 00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00006644.00000000.220399.04C10000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00006644.00000000.220399.04C10000.00000004.mdmp\n \"SOFTWARE\\Policies\\Microsoft\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"Software\\Microsoft\\RemovalTools\\MRT\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"HKLM\\\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Stats\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00006644.00000000.220399.04C10000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00006644.00000000.220399.04C10000.00000004.mdmp\n \"SOFTWARE\\Policies\\Microsoft\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"Software\\Microsoft\\RemovalTools\\MRT\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"HKLM\\\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Stats\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006644.00000000.220399.710F1000.00000020.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FC20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71220000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77000000\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 728A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71E10000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74840000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" was detected as \".NET\" and name: \"Library\"\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$31","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 6644 -ip 6644\" (UID: 00000000-00007024)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6644 -s 1072\" (UID: 00000000-00006676)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6644 -s 1072\" (UID: 00000000-00001440)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 6644 -ip 6644\" (UID: 00000000-00007024)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6644 -s 1072\" (UID: 00000000-00006676)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6644 -s 1072\" (UID: 00000000-00001440)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" queries basic process information of the \"C:\\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (UID: 6644)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.20.11.233\"\n \"1.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0,x\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n \"11.0.0.0\"\n \"17.0.0.0\"\n Potential IP \"17.12.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t17.12.0.0\"\n \"2.4.8.1\"\n \"2.7.9.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"q#.ug\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"ation.gl\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=74409&enterprise=\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=74408&enterprise=\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&\"\n Pattern match: \"https://wdcp.microsoft.com/wdcp.svc/submitreport\"\n Heuristic match: \"nw9zfwy.my\"\n Heuristic match: \"lumenmind.my\"\n Pattern match: \"http://www.validationtest.contoso.com/test%d.html\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00006644\"\n YARA signature to detect medium entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00006644\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006644\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetComputerNameW\" (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp, 00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006644.00000001.220629.711D1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006644-00000C2B-2444996838\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006644.00000001.220629.05C10000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp, 00000000-00006644.00000001.220629.711D1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00006644.00000000.220399.710F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp, 00000000-00006644.00000001.220629.711E5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006644.00000001.220629.71181000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":10,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6644)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" has section name .text with entropy \"6.476316702744684\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00006644)\n \"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" opens a process \"C:\\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe\" (UID: 00000000-00006644)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$40","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["credentialharvesting","commodity","keylogger","agenttesla"],"sample_flags":["Sample Crashed","User Comment"],"sandbox_reports":[{"id":"6911cd7298a8d0503e0d83ed","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe","analysis_start_time":"2025-11-10T11:33:07+00:00","indicators_count":{"informative":150,"suspicious":15,"malicious":4},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}],"processes":[{"pid":6644,"ppid":0,"name":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe","command_line":"","sha256":"88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522","normalized_path":"C:\\88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522.exe","uid":"00000000-00006644","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6676,"ppid":6644,"name":"WerFault.exe","command_line":"-u -p 6644 -s 1072","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006644","uid":"00000000-00006676"},{"pid":1440,"ppid":6644,"name":"WerFault.exe","command_line":"-u -p 6644 -s 1072","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006644","uid":"00000000-00001440"},{"pid":7024,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 6644 -ip 6644","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007024","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["MpClient.dll","shlwapi.dll","wow64.dll","KernelBase.dll","apphelp.dll","gdi32.dll","vcruntime140_clr0400.dll","user32.dll","ucrtbase.dll","msvcrt.dll","imm32.dll","crypt32.dll","cryptbase.dll","kernel32.dll","advapi32.dll","gpapi.dll","mscoree.dll","clrjit.dll","ntdll.dll","uxtheme.dll","wintrust.dll","amsi.dll","userenv.dll","2775GvNZ.dll","ws2_32.dll","System.ni.dll","diasymreader.dll","bcryptprimitives.dll","win32u.dll","version.dll","System.Windows.Forms.dll","wldp.dll","oleaut32.dll","slc.dll","combase.dll","VxSSL32.dll","rpcrt4.dll","sechost.dll","mscoreei.dll","Microsoft.VisualBasic.dll","MpOAV.dll","fltLib.dll","bcrypt.dll","clr.dll","System.Drawing.dll","gdi32full.dll","msvcp_win.dll","psapi.dll","profapi.dll","wow64win.dll","sspicli.dll","cryptsp.dll","ucrtbase_clr0400.dll","wow64cpu.dll","ole32.dll","mscorlib.ni.dll","sppc.dll","kernel.appcore.dll","System.Core.ni.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6911cd7298a8d0503e0d83ed"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6911cd7298a8d0503e0d83ed"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 88fc0ee92874… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 88fc0ee92874…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 88fc0ee92874… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 88fc0ee92874…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/88fc0ee9287443da3f60088a825600b81fd8548cd4a2dda386e9d3b0eaab2522"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 88fc0ee92874… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 88fc0ee92874…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]