24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 5d655af0cacc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d655af0cacc…. Threat score 100/100. 0/0 AV engines flagged this file. 4 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf"],"about":{"@type":"SoftwareApplication","name":"SSA_2025_DOCUMENTS.exe","applicationCategory":["compressed","7zip"],"identifier":"5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":4,"suspicious":32},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9a6,file/memory contains long string with (Indicator: "Aes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RC2"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RNGCryptoServiceProvider"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "Oid"; File: "Snmp.dll") file/memory contains long string with (Indicator: "DESCryptoServiceProvider"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "HMAC"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "Oid"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "Rijndael"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "SHA1CryptoServiceProvider"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "TripleDESCryptoServiceProvider"; File: "SnmpSharpNet.dll") file/memory contains long string with (Indicator: "SHA384"; File: "CagService.exe") file/memory contains long string with (Indicator: "SHA384"; File: "CsExec.Service.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Common.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "Common.dll")26:T9ce9,Found XOR loop in file "Core.XmlSerializers.dll" at offset 3163570; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3163718; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3163941; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3164089; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3164312; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3164460; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3164683; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3164831; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165054; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165202; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165425; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165573; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165796; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3165944; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3166167; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3166315; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3166538; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3166686; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3166909; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3167057; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3167280; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3167428; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3167651; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3167799; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168022; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168170; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168393; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168541; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168764; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3168912; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3169135; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3169283; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3169506; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3169654; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3169877; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170025; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170248; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170396; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170619; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170767; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3170990; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3171138; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3171361; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3171509; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3171732; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3171880; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172103; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172251; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172474; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172622; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172845; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3172993; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173216; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173364; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173587; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173735; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173958; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3174106; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3174329; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3174477; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3174700; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3174848; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175071; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175219; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175442; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175590; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175813; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3175961; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3176184; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3176332; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3176555; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3176703; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3176926; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3177074; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3177297; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3177445; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3177668; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3177816; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178039; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178187; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178410; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178558; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178781; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3178929; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3179152; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3179300; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3179523; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3179671; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3179894; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3180042; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3180265; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3180413; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3180636; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3180784; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181007; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181155; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181378; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181526; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181749; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3181897; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3182120; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3182268; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3182491; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3182639; code bytes = 30d0 Found XOR loop in file "Core.XmlSerializers.dll" at offset 1541002; code bytes = 33c1 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173061; code bytes = 8030 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173388; code bytes = 8030 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3173392; code bytes = 8030 Found XOR loop in file "Core.XmlSerializers.dll" at offset 3678671; code bytes = 8030 Found XOR loop in file "Vim25Service.XmlSerializers.dll" at offset 2749662; code bytes = 8030 Found XOR loop in file "Vim25Service.XmlSerializers.dll" at offset 4991119; code bytes = 8030 Found XOR loop in file "Vim25Service.XmlSerializers.dll" at offset 5016515; code bytes = 8030 Found XOR loop in file "Vim25Service.XmlSerializers.dll" at offset 5092578; code bytes = 8030 Found XOR loop in file "Vim25Service.XmlSerializers.dll" at offset 5176654; code bytes = 8030 Found XOR loop in file "Vim25Service.dll" at offset 754228; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 775658; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 907712; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 920699; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 972036; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 1116954; code bytes = 30d0 Found XOR loop in file "Vim25Service.dll" at offset 904958; code bytes = 33c1 Found XOR loop in file "Vim25Service.dll" at offset 1151828; code bytes = 33c1 Found XOR loop in file "Vim25Service.dll" at offset 1977527; code bytes = 33c1 Found XOR loop in file "Vim25Service.dll" at offset 1977533; code bytes = 33c1 Found XOR loop in file "Vim25Service.dll" at offset 794517; code bytes = 8030 Found XOR loop in file "Vim25Service.dll" at offset 1801872; code bytes = 8030 Found XOR loop in file "Vim25Service.dll" at offset 1860254; code bytes = 8030 Found XOR loop in file "Vim25Service.dll" at offset 1973350; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 1133605; code bytes = 30d0 Found XOR loop in file "Core.dll" at offset 418796; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 418883; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 575623; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 773462; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 1029882; code bytes = 8030 Found XOR loop in file "Core.dll" at offset 2438272; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1855116; code bytes = 30d0 Found XOR loop in file "Gui.exe" at offset 1890046; code bytes = 30d0 Found XOR loop in file "Gui.exe" at offset 2062834; code bytes = 30d0 Found XOR loop in file "Gui.exe" at offset 686856; code bytes = 33c1 Found XOR loop in file "Gui.exe" at offset 849544; code bytes = 33c1 Found XOR loop in file "Gui.exe" at offset 1755400; code bytes = 33c1 Found XOR loop in file "Gui.exe" at offset 1765969; code bytes = 33c1 Found XOR loop in file "Gui.exe" at offset 1291603; code bytes = 30040e Found XOR loop in file "Gui.exe" at offset 1309920; code bytes = 30040e Found XOR loop in file "Gui.exe" at offset 1341532; code bytes = 30040e Found XOR loop in file "Gui.exe" at offset 1342144; code bytes = 30040e Found XOR loop in file "Gui.exe" at offset 1342248; code bytes = 30040e Found XOR loop in file "Gui.exe" at offset 9586; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 582023; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 605433; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 610083; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 658982; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 783186; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1745868; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1763337; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1773341; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1813312; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1815848; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1869528; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1869532; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1904458; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1904462; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1931476; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1941929; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 1986826; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 2041120; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 2041124; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 2077246; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 2077250; code bytes = 8030 Found XOR loop in file "Gui.exe" at offset 2142848; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 309858; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 310178; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 310498; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 310990; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 311330; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 311669; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 822812; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1337976; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1337980; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1775343; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1783613; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1789937; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1795625; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1797343; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1801133; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1808363; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1814887; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1818749; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1819771; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1821771; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1826861; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1830047; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1831687; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1832843; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1833987; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1834573; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1836505; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 1836677; code bytes = 30d0 Found XOR loop in file "scvncctrl.dll" at offset 147245; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 329204; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 329226; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 329274; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 329552; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 329813; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 330074; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 330335; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 330596; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 330857; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 331118; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 627816; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 627836; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 657921; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 659325; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 659465; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 661431; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 676121; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 676220; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 676711; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 677087; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 677132; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 677235; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 677271; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 678230; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 678326; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 678810; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 678850; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 679174; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 687600; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 687618; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 687733; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 687909; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 687925; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 688249; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 688265; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 688376; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 688492; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 920745; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 954468; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 954497; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 954531; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 954555; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 954569; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1004076; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1024056; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1070539; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1070622; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1077604; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1086212; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1087289; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1087418; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1382563; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1634330; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1794395; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1800377; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1801467; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 1801797; code bytes = 33c1 Found XOR loop in file "scvncctrl.dll" at offset 477136; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1303250; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1501983; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1786704; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1790120; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1796004; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1797328; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1801048; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1809444; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1814848; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1817700; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1818730; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1820776; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1821752; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1823438; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1824516; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1825538; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1826374; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1830008; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1833378; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1833968; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1835616; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1838824; code bytes = 8030 Found XOR loop in file "scvncctrl.dll" at offset 1840016; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 511944; code bytes = 30d0 Found XOR loop in file "putty.exe" at offset 1402202; code bytes = 30d0 Found XOR loop in file "putty.exe" at offset 1542570; code bytes = 30d0 Found XOR loop in file "putty.exe" at offset 1650100; code bytes = 30d0 Found XOR loop in file "putty.exe" at offset 1661259; code bytes = 30d0 Found XOR loop in file "putty.exe" at offset 356233; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 498025; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 763352; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1328224; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1432640; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1453129; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1487669; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1503827; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1548159; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1557525; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1585545; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 1594458; code bytes = 33c1 Found XOR loop in file "putty.exe" at offset 322728; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 755387; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 985640; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1047408; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1330171; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1330716; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1379596; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1381041; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1411893; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1416151; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1432869; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1530152; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1607500; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1642005; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1652125; code bytes = 8030 Found XOR loop in file "putty.exe" at offset 1653164; code bytes = 8030 Found XOR loop in file "FSharp.Core.dll" at offset 534014; code bytes = 30d0 Found XOR loop in file "FSharp.Core.dll" at offset 317341; code bytes = 33c1 Found XOR loop in file "FSharp.Core.dll" at offset 620818; code bytes = 33c1 Found XOR loop in file "FSharp.Core.dll" at offset 623014; code bytes = 33c1 Found XOR loop in file "FSharp.Core.dll" at offset 625318; code bytes = 33c1 Found XOR loop in file "FSharp.Core.dll" at offset 302668; code bytes = 8030 Found XOR loop in file "FSharp.Core.dll" at offset 488317; code bytes = 8030 Found XOR loop in file "FSharp.Core.dll" at offset 603008; code bytes = 8030 Found XOR loop in file "FSharp.Core.dll" at offset 833464; code bytes = 8030 Found XOR loop in file "FSharp.Core.dll" at offset 1039984; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 187195; code bytes = 30d0 Found XOR loop in file "NLog.dll" at offset 370209; code bytes = 33c1 Found XOR loop in file "NLog.dll" at offset 183634; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 196941; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 221859; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 222747; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 369504; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 385504; code bytes = 8030 Found XOR loop in file "NLog.dll" at offset 402184; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 352831; code bytes = 30d0 Found XOR loop in file "Newtonsoft.Json.dll" at offset 3443; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 225703; code bytes = 8030 Found XOR loop in file "Newtonsoft.Json.dll" at offset 228215; code bytes = 8030 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 386973; code bytes = 30d0 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 213600; code bytes = 8030 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 232790; code bytes = 8030 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 247710; code bytes = 8030 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 259460; code bytes = 8030 Found XOR loop in file "Interop.MSTSCLib.dll" at offset 387068; code bytes = 8030 Found XOR loop in file "WindowsAgent.dll" at offset 381301; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381331; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381351; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381371; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381389; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381409; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 381432; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 389294; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 389309; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 394863; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 394884; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 394906; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 399805; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 399826; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 399849; code bytes = 30040e Found XOR loop in file "WindowsAgent.dll" at offset 34165; code bytes = 8030 Found XOR loop in file "WindowsAgent.dll" at offset 124435; code bytes = 8030 Found XOR loop in file "WindowsAgent.dll" at offset 142811; code bytes = 8030 Found XOR loop in file "WindowsAgent.dll" at offset 143307; code bytes = 8030 Found XOR loop in file "WindowsAgent.dll" at offset 453248; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 199985; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 234915; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 408911; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 109869; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 42169; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 107237; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 117261; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 157376; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 159912; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 214397; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 214401; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 249327; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 249331; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 276254; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 287353; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 332250; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 386689; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 386693; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 423323; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 423327; code bytes = 8030 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 100696; code bytes = 30d0 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 193531; code bytes = 33c1 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 85381; code bytes = 8030 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 86137; code bytes = 8030 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 86581; code bytes = 8030 Found XOR loop in file "WeifenLuo.WinFormsUI.Docking.dll" at offset 395290; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 100957; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 150498; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 294114; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 70542; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 115369; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 115373; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 164910; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 164914; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 177375; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 184069; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 228966; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 273403; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 273407; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 308526; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 308530; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 99066; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 148607; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 291914; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 68832; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 113478; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 113482; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 163019; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 163023; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 175462; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 182098; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 226995; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 271258; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 271262; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 306326; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 306330; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 99148; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 148689; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 291693; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 68845; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 113560; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 113564; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 163101; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 163105; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 175412; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 181965; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 226862; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 271150; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 271154; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 306105; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 306109; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 99034; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 148575; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 291196; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 68893; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 113446; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 113450; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 162987; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 162991; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 175229; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 181636; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 226533; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 270672; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 270676; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 305608; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 305612; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 98602; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 148143; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 290147; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 68599; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 113014; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 113018; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 162555; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 162559; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 174509; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 180921; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 225818; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 269752; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 269756; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 304559; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 304563; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 82468; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 132009; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 272530; code bytes = 30d0 Found XOR loop in file "Gui.resources.dll" at offset 51947; code bytes = 33c1 Found XOR loop in file "Gui.resources.dll" at offset 96880; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 96884; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 146421; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 146425; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 158544; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 162879; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 207776; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 251706; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 251710; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 286942; code bytes = 8030 Found XOR loop in file "Gui.resources.dll" at offset 286946; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 247065; code bytes = 30d0 Found XOR loop in file "uninst.exe" at offset 250493; code bytes = 30d0 Found XOR loop in file "uninst.exe" at offset 251731; code bytes = 33c1 Found XOR loop in file "uninst.exe" at offset 253827; code bytes = 33c1 Found XOR loop in file "uninst.exe" at offset 240039; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 248608; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 249482; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 250484; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 252710; code bytes = 8030 Found XOR loop in file "uninst.exe" at offset 266104; code bytes = 8030 Found XOR loop in file "ICSharpCode.SharpZipLib.dll" at offset 42192; code bytes = 8030 Found XOR loop in file "ICSharpCode.SharpZipLib.dll" at offset 119754; code bytes = 8030 Found XOR loop in file "Snmp.dll" at offset 56585; code bytes = 30d0 Found XOR loop in file "Snmp.dll" at offset 83283; code bytes = 33c1 Found XOR loop in file "Snmp.dll" at offset 37951; code bytes = 8030 Found XOR loop in file "Snmp.dll" at offset 136430; code bytes = 8030 Found XOR loop in file "Snmp.dll" at offset 180864; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 161833; code bytes = 30d0 Found XOR loop in file "SimpleFC.dll" at offset 165261; code bytes = 30d0 Found XOR loop in file "SimpleFC.dll" at offset 166499; code bytes = 33c1 Found XOR loop in file "SimpleFC.dll" at offset 168595; code bytes = 33c1 Found XOR loop in file "SimpleFC.dll" at offset 154807; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 163376; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 164250; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 165252; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 167478; code bytes = 8030 Found XOR loop in file "SimpleFC.dll" at offset 171356; code bytes = 8030 Found XOR loop in file "SnmpSharpNet.dll" at offset 53635; code bytes = 803027:T36bc,"\:i" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt039g(yyy+p/*i[omwashington1redmond1microsoft" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000816.00000001.311034.00950000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00000816.00000001.311034.00D73000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00000816.00000001.311034.00D73000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00000816.00000001.311034.00D73000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00000816.00000001.311034.00D73000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00000816.00000001.311034.00D73000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infodownload" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadusage:" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundfailed" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os=8.0.21" - Source: "00000000-00000816.00000001.311034.5ED92000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00001196.00000000.312987.00DF3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00001196.00000000.312987.00DF3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00001196.00000000.312987.00DF3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00001196.00000000.312987.00DF3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00001196.00000000.312987.00DF3000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimersds^d:\a\_work\1\s\artifacts\obj\system.runtime\release\net8.0\system.runtime.pdbsha256_cordllmainmscoree.dll" - Source: "00000000-00001196.00000001.314608.5F4E2000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001196.00000001.314608.68941000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001196.00000001.314608.6F0D1000.00000020.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00001196.00000001.314608.730D1000.00000020.mdmp") Found URL "https://aka.ms/serializationformat-binary-obsolete" - Source: "00000000-00001196.00000001.314608.730D1000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001196.00000001.314608.730D1000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001196.00000001.314608.730D1000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001196.00000001.314608.73321000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001196.00000001.314608.73321000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001196.00000001.314608.73431000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00001924.00000000.308256.00FD3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00001924.00000000.308256.00FD3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00001924.00000000.308256.00FD3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00001924.00000000.308256.00FD3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00001924.00000000.308256.00FD3000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001924.00000001.309093.5C2C1000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001924.00000001.309093.5C301000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001924.00000001.309093.5C301000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001924.00000001.309093.5C321000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00001924.00000001.309093.5C321000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimewindowsbsjbv4.0.30319" - Source: "00000000-00001924.00000001.309093.5C341000.00000020.mdmp") Found URL "https://nlog-project.org/" - Source: "00000000-00001924.00000001.309093.5C372000.00000020.mdmp") Found URL "https://www.nuget.org/packages/nlog.web.aspnetcore" - Source: "00000000-00001924.00000001.309093.5C372000.00000020.mdmp") Found URL "https://github.com/nlog/nlog.gitmessageyuse" - Source: "00000000-00001924.00000001.309093.5C372000.00000020.mdmp") Found URL "https://github.com/dotnet/runtime/v'crsdsf/_/artifacts/obj/netstandard/release/net8.0-windows/netstandard.pdbsha256_cordllmainmscoree.dll" - Source: "00000000-00001924.00000001.309093.5C462000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimersds^d:\a\_work\1\s\artifacts\obj\system.runtime\release\net8.0\system.runtime.pdbsha256_cordllmainmscoree.dll" - Source: "00000000-00001924.00000001.309093.689E2000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimersdsd:\a\_work\1\s\artifacts\obj\system.text.encoding.extensions\release\net8.0\system.text.encoding.extensions.pdbsha256_cordllmainmscoree.dll" - Source: "00000000-00001924.00000001.309093.6E972000.00000020.mdmp") Found URL "http://sv.symcb.com/sv.crl0az0x0v0l0" - Source: "00000000-00002384.00000001.303023.00320000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/sv.crt0u" - Source: "00000000-00002384.00000001.303023.00320000.00000004.mdmp") Found URL "http://nlog-project.org/" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "https://www.nuget.org/packages/nlog.web.aspnetcore" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/ilogreceiverserver/processlogmessagestreplyactionhhttp://nlog-project.org/ws/ilogreceiverserver/processlogmessagesresponsepisonewayasyncpatternactionfhttp://nlog-project.org/ws/ilogreceiveronewayserver/processlogmessagesisonewayformatequals" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/tconfigurationname*nlog.logreceiverservice.ilogreceiverclientuse" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/tconfigurationname0nlog.logreceiverservice.ilogreceiveronewayclient," - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/5name" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/<7event" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/3events" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/count" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://nlog-project.org/ws/" - Source: "00000000-00002384.00000001.303023.00512000.00000020.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002384.00000001.303023.03740000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt08" - Source: "00000000-00002384.00000001.303023.03740000.00000004.mdmp") Found URL "http://crt.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4co?(ka,t=07;^a:" - Source: "00000000-00002384.00000001.303023.03740000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002384.00000001.303023.046A2000.00000020.mdmp") Found URL "http://crt.rootg2.amazontrust.com/rootg2.cer.managent," - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt08" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://crl.r2m03.amazontrust.com/r2m03.crl0ui0g0-!http://ocsp.r2m03.amazontrust.com06*http://crt.r2m03.amazontrust.com/r2m03.cer0/z<@1" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0c5" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpubws-pc192.168.0.1255.255.255.255iysvqpubws-pc192.168.0.1255.255.255.255pubws-pc192.168.0.1255.255.255.255pubws-pc192.168.0.1255.255.255.255h&" - Source: "00000000-00002384.00000002.304944.03740000.00000004.mdmp") Found URL "http://ocsp.entrust.netintvaluewrite7_intvalueboolvaluewrite6_boolvaluelongvaluewrite8_longvaluedoublevaluewrite10_doublevaluefloatvaluewrite9_floatvaluesystem.collections.genericlist" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootg2.crt0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=6040mlv_w1" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ogte" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0bhttp://crl3.digicert.com/digicertglobalg2tlsrsasha2562020ca1-1.crl0hbhttp://crl4.digicert.com/digicertglobalg2tlsrsasha2562020ca1-1.crl0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0qehttp://cacerts.digicert.com/digicertglobalg2tlsrsasha2562020ca1-1.crt0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl07>(ap1<92a@efnp(-" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/jom5osalt" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl7>ka6" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!>&@@work1!0?.jainternet1verisign," - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nmsft1200)microsoft" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7>8&af$\_)$bf!7=taeris" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,oc*9.x^ybsy-d" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!&s_cogte" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0xkc9washington1redmond1microsoft" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?xx4bn&i" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.c7=zcjo&$uhk" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0c5" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.r2m03.amazontrust.com/r2m03.crl0ui0g0-!http://ocsp.r2m03.amazontrust.com06*http://crt.r2m03.amazontrust.com/r2m03.cer0/z<@1" - Source: "00000000-00002384.00000002.304944.05CA0000.00000004.mdmp") Found URL "http://crl.r2m03.amazontrust.com/r2m03.crl0ui0g0-!http://ocsp.r2m03.amazontrust.com06*http://crt.r2m03.amazontrust.com/r2m03.cer0/z<@1" - Source: "00000000-00002384.00000002.304944.06540000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0c5" - Source: "00000000-00002384.00000002.304944.06540000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00002384.00000002.304944.06540000.00000004.mdmp") Found URL "http://crl.r2m03.amazontrust.com/r2m03.crl0ui0g0-!http://ocsp.r2m03.amazontrust.com06*http://crt.r2m03.amazontrust.com/r2m03.cer0/z<@1" - Source: "00000000-00002384.00000002.304944.06560000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0c5" - Source: "00000000-00002384.00000002.304944.06560000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00002384.00000002.304944.06560000.00000004.mdmp") Found URL "http://www.newtonsoft.com/jsonschema" - Source: "00000000-00002384.00000002.304944.06712000.00000020.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00002384.00000002.304944.06712000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00003608.00000001.312697.013D3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00003608.00000001.312697.013D3000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00003608.00000001.312697.013D3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00003608.00000001.312697.013D3000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00003608.00000001.312697.013D3000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00003608.00000001.312697.5A811000.00000020.mdmp") Found URL "https://aka.ms/serializationformat-binary-obsolete" - Source: "00000000-00003608.00000001.312697.5A811000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003608.00000001.312697.5A811000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00003608.00000001.312697.5A811000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00003608.00000001.312697.5CFC1000.00000020.mdmp") Found URL "https://aka.ms/dotnet/infodownload" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadusage:" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundfailed" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os=8.0.21" - Source: "00000000-00003608.00000001.312697.5EDE2000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimersds^d:\a\_work\1\s\artifacts\obj\system.runtime\release\net8.0\system.runtime.pdbsha256_cordllmainmscoree.dll" - Source: "00000000-00003608.00000001.312697.5EEE2000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003608.00000001.312697.5F3E1000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00003608.00000001.312697.5F3E1000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00003608.00000001.312697.5F401000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimebsjbv4.0.30319" - Source: "00000000-00003608.00000001.312697.5F4C1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00003812.00000000.315010.01163000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00003812.00000000.315010.01163000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00003812.00000000.315010.01163000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00003812.00000000.315010.01163000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00003812.00000000.315010.01163000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infodownload" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadusage:" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundfailed" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os=8.0.21" - Source: "00000000-00003812.00000000.315010.731C2000.00000002.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3d:///c:/program" - Source: "00000000-00003872.00000001.303645.003F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crlntrustedsa/sha1raudulentntrustedntrustedntrustedntrustedsa/sha1subcaraudulentntrustedntrustedsa/sha1raudulentsa/sha1raudulentsa/sha1ttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlraudulentsa/sha1raudulentntrustedntrustedntrustedntrustedntrustedntrustedsa/sha1raudulentsa/sha1raudulentntrustedicrosoft" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlconnecticutnorwalkdatto," - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3da35ed" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3dc8e534ee129f27d55460ce17fd628216_??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649oft\cryptneturlcache\content\8ec9b1d0abbd7f98b401d425828828ce_c5eb5a18462aefa298ca0164dd86d4b7??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649?\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll352303c95nintel(r)" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3dtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaeqm1hxe5evbnz8ica6z0k%3dtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaeqm1hxe5evbnz8ica6z0k%3dlocal" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crln" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc)" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0inetaaaahconaaaahconaaaainetaaaahconzzzzinetaaaahconaaaainetaaaahconaaaa0a0" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n)wp+(0p1+0)" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!internet1verisign," - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,x7y1;8kb%2+josalt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikgif0f$\_)$bf!ki0!!salt" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusopijlf0cth" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t86a[jr0m0]>-xgjxx4bgeotrust" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l']qqpd?@>z>ic/gp-h5t[u]" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3dapioapionnectionep-aliveer-agent23.140.1.4.1s.ui01.3.6.1.5.5.7.3.11.3.6.1.5.5.7.3.81.2.840.113549.1.9.16.1.11.2.840.113549.1.9.16.2.1essreceiptrequestencodeex1.2.840.113549.1.9.16.2.11esskeyexchpreferenceencodeex1.2.840.113549.1.9.16.2.12esssigncertificateencodeex1.2.840.113549.1.9.16.2.2esssecuritylabelencodeex1.2.840.113549.1.9.16.2.31.2.840.113549.1.9.16.2.4f4d-b11e-488912826651" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" - Source: "00000000-00003872.00000001.303645.010B0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00003872.00000001.303645.02110000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003872.00000001.303645.02110000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003872.00000001.303645.02110000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceaitqljg0pxmn17nqb2trtk%3dmeiryo" - Source: "00000000-00003872.00000002.305568.003F0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl:\windows\microsoft.net\assembly\gac_msil\smdiagnostics\v4.0_4.0.0.0__b77a5c561934e089\smdiagnostics.dll:\windows\microsoft.net\assembly\gac_msil\system.drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.drawing.dll:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll:\windows\microsoft.net\assembly\gac_msil\smdiagnostics\v4.0_4.0.0.0__b77a5c561934e089\smdiagnostics.dll:\windows\microsoft.net\assembly\gac_msil\system.design\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.design.dll:\windows\microsoft.net\assembly\gac_msil\system.drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.drawing.dllraudulentsa/sha1raudulentntrustedntrustedntrustedntrustedntrustedntrustedsa/sha1raudulentsa/sha1raudulentntrustedicrosoft" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crllocal" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crl\windows\microsoft.net\assembly\gac_32\system.transactions\v4.0_4.0.0.0__b77a5c561934e089\system.transactions.dll:\windows\microsoft.net\assembly\gac_32\system.transactions\v4.0_4.0.0.0__b77a5c561934e089\system.transactions.dllp" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc)" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0hconzzzz0a0" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n)wp+(inamepropinamepropinamepropinamepropinamepropinamepropinamepropinameprop0p1+0)" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!internet1verisign," - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,x7y1;8kb%2+josalt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikgif0f$\_)$bf!ki0!!salt" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusopijlf0cth" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t86a[jr0m0]>-xgjxx4bgeotrust" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l']qqpd?@>z>ic/gp-h5t[u]" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003872.00000002.305568.010B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca\"; File: \"System.Collections.dll\")\n file/memory contains long string with (Indicator: \"\"; File: \"System.Collections.dll\")\n file/memory contains long string with (Indicator: \"\"; File: \"Tommy.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Canary failed to create ping event. gle=%d\" (Indicator: \"ping\"; Source: \"00000000-00000816.00000000.309981.5DF32000.00000002.mdmp, 00000000-00000816.00000001.311034.5DF32000.00000002.mdmp, 00000000-00001196.00000000.312987.5DF92000.00000002.mdmp, 00000000-00001924.00000001.309093.5DF92000.00000002.mdmp, 00000000-00003608.00000001.312697.5DF92000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Gui.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfiga\"; File: \"SimpleSC.dll\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"System.Security.AccessControl.dll\")\n file/memory contains long string(File: \"System.IO.FileSystem.AccessControl.dll\")\n file/memory contains long string(File: \"System.IO.IsolatedStorage.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Gui.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003872)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\ProgramData\\CentraStage\\Temp\\fdf59eaa-8dda-41ef-a33e-ec2a2be702b2\\AEMAgent.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000816.00000000.309981.00340000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\ProgramData\\CentraStage\\AEMAgent\\.net.runtime\\8.0.21\\shared\\Microsoft.NETCore.App\\8.0.21\\coreclr.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000816.00000001.311034.00340000.00000004.mdmp, 00000000-00001196.00000000.312987.003C0000.00000004.mdmp, 00000000-00001196.00000001.314608.003C0000.00000004.mdmp, 00000000-00001924.00000000.308256.00520000.00000004.mdmp, 00000000-00001924.00000001.309093.00520000.00000004.mdmp, 00000000-00003608.00000000.311475.00110000.00000004.mdmp, 00000000-00003608.00000001.312697.00110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; Source: \"00000000-00000816.00000000.309981.5DF32000.00000002.mdmp, 00000000-00000816.00000001.311034.5DF32000.00000002.mdmp, 00000000-00001196.00000000.312987.5DF92000.00000002.mdmp, 00000000-00001924.00000001.309093.5DF92000.00000002.mdmp, 00000000-00003608.00000001.312697.5DF92000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"00000000-00000816.00000000.309981.5DF32000.00000002.mdmp, 00000000-00000816.00000001.311034.5DF32000.00000002.mdmp, 00000000-00001196.00000000.312987.5DF92000.00000002.mdmp, 00000000-00001924.00000001.309093.5DF92000.00000002.mdmp, 00000000-00003608.00000001.312697.5DF92000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000816.00000000.309981.5DF32000.00000002.mdmp, 00000000-00000816.00000001.311034.5DF32000.00000002.mdmp, 00000000-00001196.00000000.312987.5DF92000.00000002.mdmp, 00000000-00001924.00000001.309093.5C372000.00000020.mdmp, 00000000-00001924.00000001.309093.5DF92000.00000002.mdmp, 00000000-00002384.00000001.303023.00512000.00000020.mdmp, 00000000-00003608.00000001.312697.5DF92000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000816.00000000.309981.5DF32000.00000002.mdmp, 00000000-00000816.00000001.311034.5DF32000.00000002.mdmp, 00000000-00001196.00000000.312987.5DF92000.00000002.mdmp, 00000000-00001924.00000001.309093.5DF92000.00000002.mdmp, 00000000-00003608.00000001.312697.5DF92000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Process deletes itself","description":"\"%PROGRAMFILES%\\CentraStage\\Gui.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Gui.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3872)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"createdump.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Gui.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003872)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Gui.exe\" (Thread ID: 3348) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"\"GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com\" Response ==> HTTP/1.1 200 OK\nLast-Modified: Mon\n 03 May 2021 17:17:22 GMT\nETag: \"60903022-6b4\"\nContent-Type: application/pkix-cert\nContent-Length: 1716\nAccept-Ranges: bytes\nMPULSE_CDN_CACHE: HIT\nMPULSE_ORIGIN_TIME: 0\nCache-Control: public\n max-age=37648\nExpires: Tue\n 03 Mar 2026 10:01:30 GMT\nDate: Mon\n 02 Mar 2026 23:34:02 GMT\nConnection: keep-alive\nAkamai-GRN: 0.1a933617.1772494442.61fa2ca with response body ==>30C28206C2B030C28204C298C2A003020102021008C2AD40C2B260C392C29C4CC29F5EC38DC2A9C2BDC293C2AEC399300D06092AC28648C286C3B70D01010C05.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"file/memory contains long string(File: \"RWDetectCore.dll\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-634","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 681 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Gui.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"690101df\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Gui.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68010c2c\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"Gui.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"08000000c05a3002\"\n \"szDataDescr\": \"2111230\"\n \"pDataOut\": \"e6000000b0da4700\"\n \"$datain\": \"password\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Gui.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Gui.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SSA_2025_DOCUMENTS.exe\" wrote 32 bytes to a remote process \"C:\\Program Files\\CentraStage\\Gui.exe\" (Handle: 436)\n \"SSA_2025_DOCUMENTS.exe\" wrote 52 bytes to a remote process \"C:\\Program Files\\CentraStage\\Gui.exe\" (Handle: 436)\n \"SSA_2025_DOCUMENTS.exe\" wrote 4 bytes to a remote process \"C:\\Program Files\\CentraStage\\Gui.exe\" (Handle: 436)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - RiskTool.Mimikatz","description":"YARA signature RiskTool.Mimikatz matched on file \"RWDetectCore.dll\"","origin":"YARA Signature","mitre_attack_id":"T1550.002","relevance":9,"id":"yara-13","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":146,"dropped_files_count":0,"extracted_files_count":276,"files_written_count":150,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["urlscanio","evasive","ransomware"],"sample_flags":["Extracted Files","Sample Crashed","User Comment","Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"69a629334f3852fed70d9e50","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf.bin","analysis_start_time":"2026-03-03T00:20:05+00:00","indicators_count":{"informative":144,"suspicious":30,"malicious":2},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"69a61e164a103c680407bae3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"SSA_2025_DOCUMENTS.exe","analysis_start_time":"2026-03-02T23:32:40+00:00","indicators_count":{"informative":236,"suspicious":54,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"cacerts.digicert.com","address":"184.31.68.248","ttl":248,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}],"http_requests":[{"host":"cacerts.digicert.com","host_ip":"184.31.68.248:80","url":"/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}],"processes":[{"pid":7328,"ppid":0,"name":"5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf.bin.exe","command_line":"","sha256":"5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf","normalized_path":"C:\\5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf.bin.exe","uid":"00000000-00007328","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACk0lEQVR4Xu2W2Y7aQBBF58cTDfsyBrODzb7+EC+Zh4l4QQGBhIQUdqj4GtpuGmMolLfE0tUwGo3PqaK7ut/e/j8eT7/fJ6TX61G326VOp0Ptdoda7Ta1Wi1qNpvUaDSoXm9QrV6naq1GZrVKplklwzCpbv2tUCiQ+t6nH8CPx+NNDnIOag50Op1oMBjQaDSypV6WQOUA7vd72iE7kR1tRbbnn5utyNaWgMByuaSvr59kmCbpr0ig7V4CDhyffQQWiwXN53P68flJ5YpBuq7zJPCdQ8CGewkA7oBvBWazGU2nUxqPxzQcDqlUKvMEsOAcgXvtl8CqgKZpV8nkcjwBrHZbwIH7tH/jCuDzxKr810RkYnVjTplslilgbTUh4IIluEf7hcBaznpjraMD6RmmAPY5ttpDuFL9tcDGEUjrGZ4AhsxZAB1wwdcrX4J7VW8JrC4CqTRzF2DCYbh4g/G7gPtXLwS0dJongPFqd0ABX7f9HtytXgh8pFI8AYxRdOAG7MDdtnvBRfWOgMYUwMGCPe1AZBEGXAgkPzSmgAkBuQMXqC98ewM/C+wpkfzgCeBIdTqgQD3BHpWLYJrGk0meQMUwzgIS1BvsD1+t1rZALMEUKFcqtLcEbmFq/OG/LwLReIInUCqXHwicwY/gjkAszhMollSBjRs/sAIXApFojClQLNnbR8AeQi+RwbJAOBrlCRSKRVtABdyNB1gWCEWYAnnrHveUgAdQDQSC4QhPIJf3E1g/BZYFAqEwTyCby9sTTMA4QDW2QDDEE8AdDv+ovuyV4D3vbAHrDufciP9CvgeCPAHc4XCNwk0Glwmc5zhScarhYMFsx3jFhMOQwT7HVsNqx4LDd462o3LAv70HeAL/1PMHltdlzrwAwvsAAAAASUVORK5CYII="},{"pid":4444,"ppid":7328,"name":"WerFault.exe","command_line":"-u -p 7328 -s 1072","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007328","uid":"00000000-00004444"},{"pid":7104,"ppid":7328,"name":"WerFault.exe","command_line":"-u -p 7328 -s 1072","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007328","uid":"00000000-00007104"},{"pid":5672,"ppid":7328,"name":"WerFault.exe","command_line":"-u -p 7328 -s 1072","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007328","uid":"00000000-00005672"},{"pid":6852,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 7328 -ip 7328","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006852","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACk0lEQVR4Xu2W2Y7aQBBF58cTDfsyBrODzb7+EC+Zh4l4QQGBhIQUdqj4GtpuGmMolLfE0tUwGo3PqaK7ut/e/j8eT7/fJ6TX61G326VOp0Ptdoda7Ta1Wi1qNpvUaDSoXm9QrV6naq1GZrVKplklwzCpbv2tUCiQ+t6nH8CPx+NNDnIOag50Op1oMBjQaDSypV6WQOUA7vd72iE7kR1tRbbnn5utyNaWgMByuaSvr59kmCbpr0ig7V4CDhyffQQWiwXN53P68flJ5YpBuq7zJPCdQ8CGewkA7oBvBWazGU2nUxqPxzQcDqlUKvMEsOAcgXvtl8CqgKZpV8nkcjwBrHZbwIH7tH/jCuDzxKr810RkYnVjTplslilgbTUh4IIluEf7hcBaznpjraMD6RmmAPY5ttpDuFL9tcDGEUjrGZ4AhsxZAB1wwdcrX4J7VW8JrC4CqTRzF2DCYbh4g/G7gPtXLwS0dJongPFqd0ABX7f9HtytXgh8pFI8AYxRdOAG7MDdtnvBRfWOgMYUwMGCPe1AZBEGXAgkPzSmgAkBuQMXqC98ewM/C+wpkfzgCeBIdTqgQD3BHpWLYJrGk0meQMUwzgIS1BvsD1+t1rZALMEUKFcqtLcEbmFq/OG/LwLReIInUCqXHwicwY/gjkAszhMollSBjRs/sAIXApFojClQLNnbR8AeQi+RwbJAOBrlCRSKRVtABdyNB1gWCEWYAnnrHveUgAdQDQSC4QhPIJf3E1g/BZYFAqEwTyCby9sTTMA4QDW2QDDEE8AdDv+ovuyV4D3vbAHrDufciP9CvgeCPAHc4XCNwk0Glwmc5zhScarhYMFsx3jFhMOQwT7HVsNqx4LDd462o3LAv70HeAL/1PMHltdlzrwAwvsAAAAASUVORK5CYII="}],"all_imported_dlls":["ucrtbase.dll","windows.storage.dll","bcryptprimitives.dll","aepic.dll","kernel32.dll","gdi32.dll","cfgmgr32.dll","wow64win.dll","sspicli.dll","System.dll","apphelp.dll","cryptbase.dll","powrprof.dll","msxml3.dll","ntmarta.dll","SHCore.dll","shlwapi.dll","userenv.dll","nsisXML.dll","cscapi.dll","clbcatq.dll","version.dll","cldapi.dll","ntshrui.dll","shell32.dll","sechost.dll","rpcrt4.dll","user32.dll","KernelBase.dll","combase.dll","VxSSL32.dll","ws2_32.dll","propsys.dll","SimpleFC.dll","wow64cpu.dll","oleaut32.dll","srvcli.dll","win32u.dll","comctl32.dll","oleacc.dll","advapi32.dll","ole32.dll","shfolder.dll","FirewallAPI.dll","fwbase.dll","gdi32full.dll","profapi.dll","cryptsp.dll","bcrypt.dll","msvcp_win.dll","imm32.dll","uxtheme.dll","dwmapi.dll","linkinfo.dll","fwpolicyiomgr.dll","setupapi.dll","ntdll.dll","wow64.dll","msvcrt.dll","kernel.appcore.dll","fltLib.dll","crypt32.dll","gpapi.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","mscoreei.dll","wintrust.dll","msasn1.dll","webio.dll","System.Runtime.Remoting.ni.dll","api-ms-win-core-synch-l1-2-0.dll","nlssorting.dll","SensApi.dll","wship6.dll","WindowsCodecs.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Core.XmlSerializers.dll","nsi.dll","msxml3r.dll","mswsock.dll","riched20.dll","dhcpcsvc6.dll","System.Runtime.Serialization.ni.dll","System.Security.ni.dll","netutils.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","IPHLPAPI.DLL","oleaccrc.dll","WSHTCPIP.DLL","rasadhlp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","Core.dll","System.Xml.ni.dll","ncrypt.dll","WindowsAgent.dll","wtsapi32.dll","Wldap32.dll","SimpleSC.dll","clrjit.dll","winnsi.dll","System.ServiceModel.dll","slc.dll","mscorlib.ni.dll","wininet.dll","dhcpcsvc.dll","imagehlp.dll","mscorrc.dll","clr.dll","System.ni.dll","System.Core.ni.dll","FWPUCLNT.DLL","mscoree.dll","rpcss.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","System.Data.dll","mscorsecimpl.dll","NLog.dll","usp10.dll","nsProcess.dll","RpcRtRemote.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","cryptnet.dll","System.Web.Services.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Windows.Forms.dll","devobj.dll","wshqos.dll","GdiPlus.dll","ucrtbase_clr0400.dll","System.Configuration.ni.dll","lpk.dll","vcruntime140_clr0400.dll","winhttp.dll","winsta.dll","nsSCM.dll","rsaenh.dll","urlmon.dll","secur32.dll","normaliz.dll","dnsapi.dll","msctf.dll","api-ms-win-core-xstate-l2-1-0.dll","credssp.dll","System.Data.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Core.XmlSerializers.dll","sha256":"e33f9f5045b28a1a1b0b699858d56e1661f3adc61094b31e04f333be56d9220b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Vim25Service.XmlSerializers.dll","sha256":"cba8ae7d31f74b721ed2949db54bb6dd835acc478961748a56d3805cb2010f99","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Core.dll","sha256":"4d47bbb4ff0b6739fb6e069087b6d73b0e2ebc173da9fa47a3a94fcbc506d9f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Core.dll","sha256":"9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Gui.exe","sha256":"5cb69d880a0ceb97926036debb3e01ea2095e8766f49cedf27658a18002cf217","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Interop.MSTSCLib.dll","sha256":"dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"NLog.dll","sha256":"5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Newtonsoft.Json.dll","sha256":"ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Vim25Service.dll","sha256":"8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"WeifenLuo.WinFormsUI.Docking.dll","sha256":"8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"WindowsAgent.dll","sha256":"5913c5adf3d13df54f269072777d520e5beab2b9f2e263393ed13c83266568cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Gui.resources.dll","sha256":"a4bc2e6b6674207624c26fdbeaf19e6274e23ec9d5f62785f0033add148826be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"putty.exe","sha256":"e61b8f44ab92cf0f9cb1101347967d31e1839979142a4114a7dd02aa237ba021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"scvncctrl.dll","sha256":"e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"CagService.exe","sha256":"eb209f6eccdebca405183de5f24ef34ee8c850615e6ab9f086f5a4fb6851e071","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Common.dll","sha256":"74e9ea4521981be2e6f2ed16ac290a7c02edda5a5c9667e73c81f6e26279e19e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"CsExec.Service.exe","sha256":"88773a254a7e056a83d6eb7d80b57cc0195cc16bca8317ea35a0576b6a38c639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"ICSharpCode.SharpZipLib.dll","sha256":"40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Threading.Tasks.Extensions.Desktop.dll","sha256":"f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Threading.Tasks.Extensions.dll","sha256":"92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Threading.Tasks.dll","sha256":"5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Snmp.dll","sha256":"f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"SnmpSharpNet.dll","sha256":"b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.dll","sha256":"24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.dll","sha256":"dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Tasks.dll","sha256":"d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"SimpleFC.dll","sha256":"11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Agent Browser.lnk","sha256":"74633b51f1b9b584515bf9f66ac66ca05b941f8882660fce29b8cb316d7609db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Agent Monitor.lnk","sha256":"d34f045be9c2f5cd87808826a1af517ed2cfb2f5f43b2c4fe1aff6377e94347c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Uninstall Agent.lnk","sha256":"760317582f33a4c9cca80f781c74ae9bcf4f3bae01606ec49762dc054d3abe1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"AxInterop.MSTSCLib.dll","sha256":"f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"AxInterop.ViewerX.dll","sha256":"c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"CSIcon.ico","sha256":"b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"CagService.exe.config","sha256":"e4058fa471acbc9ba53ee2234d8a7f7f0217d1eb06956e65e6d94c92841844e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"FsLexYacc.Runtime.dll","sha256":"b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Gui.exe.config","sha256":"71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"Interop.ViewerX.dll","sha256":"0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Licenses.txt","sha256":"f80d5184b1705e2065e5b30e06448d357117e5d7b88e642b79f091e876b641ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"Transitions.dll","sha256":"9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"uninst.exe","sha256":"dc6cf05cde0f011869a289faa32a791994e200a3fbaff3e30678d67672ed3543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.dll","sha256":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"nsisXML.dll","sha256":"c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"coreclr.dll","sha256":"fd638a30b88cb61d2c93c478cccd9dbc0cbe589db84fb64a6a9d162c6681bc38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"AEMAgent.dll","sha256":"1cba0665dfe97d666b95c5867e5fef0869aae2fb8b6e9468966fe172dbf3c3c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Linq.Expressions.dll","sha256":"071be74970672e1866b6fa8370d43cb48f0d743c829c03db53c20d30d33f2384","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Util.dll","sha256":"595988e0bb44f872bf9cd0f04983f3eed7ad2eca636fa8f0cf5b6538a98803f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"BouncyCastle.Crypto.dll","sha256":"f42b8609854d80d7f81f276340504aa5e82bbe4d73d05080fef1fcca2444b4d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Data.Common.dll","sha256":"565adcae30292b7f7ed33b792e50a54a578e51fe24861ae57d8e424efbd6738b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.Primitives.dll","sha256":"21804e970c13be46fd3977287f0e6e97e54d939a73dd3a2f8a1e099677f23b24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.DiaSymReader.Native.x86.dll","sha256":"6564545beab3cb9cd35cfb0cb77d4ec8ba3297d384e98f2fa24c536184e7830f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Private.DataContractSerialization.dll","sha256":"2ca792a77ef49b0562c25e0deb48a3b3aef71041d09c51bb24c6b96fb7c79cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.dll","sha256":"a73577d3802d210cd52f0b19a891bd7466b20f1065612c2f807b7f5727fe704e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"SimpleSC.dll","sha256":"e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Private.CoreLib.dll","sha256":"66ecebe6e12375cac302a67cbd152039a3963db5e0de22bff349c332a9d190cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Http.dll","sha256":"8b113181bc05d89188998e7657af0d08314906b724337852a30b7cac7ff05e1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"clrjit.dll","sha256":"6b7f22fbddea667de0afbfd72232863895b64247b94264b7d14e6afd93f3065e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reactive.dll","sha256":"2b6c31dfb1fc6019a42a007ed0e5e00574de6ea0c47fed0ca282bf3bb2771b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.Json.dll","sha256":"910c9db045e51f1ac315568f3aa9f9bf537e7e76d05a3a16214456606a5ee19e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"mscordaccore.dll","sha256":"ee19deb30712844885820461712f57ae64171a7b7bc7bad56b772e981e25069d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"mscordbi.dll","sha256":"7794a076f70d2d3f06af6e2a29690546c395dd392c69718b1847f5bb3d6049c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.VisualBasic.Core.dll","sha256":"19a82dff31f99de67442012566aa91e59e4e586b3962d52411d3394983327495","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Metadata.dll","sha256":"b3bdae5111ba7c146e06dbe2f75d026fae945e98c18b6da02abe9599fe5f8b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.RegularExpressions.dll","sha256":"c3b6082c568048dc3c79fff7fe8e54918262c1add0384dd2148b8021b0f56a54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.CSharp.dll","sha256":"0c7ebacf75ea98585d73ec90b363c91e65829d951b27861c33a25ca3e475703b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.Encoding.CodePages.dll","sha256":"7c6f40896b8571c995cd3fee13978225ab428e7c6b184a9ab22b353bc23343dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.EventLog.Messages.dll","sha256":"15794cca1e1abe5f3240c1b17678c203a8a414ffbfef4154bf9c1ff4327d8fdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"NetworkNode.Core.dll","sha256":"23bf0c984e4b115ce0c7d3ab44558ec9f955786034cd01ba4f896a94bf9cd414","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Compression.Native.dll","sha256":"7cdea19d1a5a08f21dc90d0dd383e11e48897f736c87b40d59160b4235e29b81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Collections.Immutable.dll","sha256":"a9cc97233610da45da9d5d5698a3a5c98583befa1c7a4b1f268f5d4aa91fe235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Linq.Parallel.dll","sha256":"98d516c16edaf1df42af6be93c1620be223f45410cb60a825e06162836138a8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.TypeConverter.dll","sha256":"ea914784fac8850fd7c1412dd0939a2a440014b6b1abdf189bbcbf686712d61e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Security.dll","sha256":"0dae319fae23802ac9c0012e1eb39255bde854ccdbd5f3b8c07eca017a782a14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Transactions.Local.dll","sha256":"c2f305724a0f5f8fb0a61bf7d9c0dd0b0d690253943c7e7526028e07e547a367","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.HttpListener.dll","sha256":"a37bc2f1f962c8636eecbe8e3e020893a439b7bd75d9e49b39cb18041d69b52a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Linq.dll","sha256":"b00feb4cb74b93558c0d6942936caebbfd085be9541993612559b9dfbf5bd814","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Sockets.dll","sha256":"399b72c9f18d5c00b6c34f2eee447a40a48d7c1ae61479e839b5349a7ccd1a58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Configuration.ConfigurationManager.dll","sha256":"5063907193e5a1e50deb48cf263c931b439456b2105497ef33054e39887bd0ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Html.Core.dll","sha256":"2ff70497caa7b69ecd3445f0d28c9e81d2931914f4dfaedd523352facbc4beaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Tasks.Dataflow.dll","sha256":"f9c3599fc57fe57a1a5b724ac286437e3881238753d3ce3b5cc1b02ba369fcc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Mail.dll","sha256":"d0291b9efb13f3499dd88dc131db4dc6043d45058f4a460a8be199c3b69c0dfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.DiagnosticSource.dll","sha256":"62cb86466651585355a0adce0b1b1f582564fa99bbae3782d624626672101d2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Private.Xml.Linq.dll","sha256":"28b3b529a9b40eb9465088fc7a1da45a363b2d4f27dcb93c8610439b2d7cd24e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Requests.dll","sha256":"3547b996222c57d9656ebd77c0408618b7426c17d1d584793f9404169dcf6904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Pkcs.dll","sha256":"8b0c588fd8ef03a658f71c868a0427f715a2861f42d65ae5ebe6e96bacf55f0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Numerics.dll","sha256":"350c24653ab647d8ae9f0b726b748e873621b2e76c7a8bf6a024def07a2cc3e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Management.dll","sha256":"c7d977c7daa173940461995bb233a1fb3cc1f5d40602655355e011f85cf83a3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"clretwrc.dll","sha256":"e0056cf62e7048c722f9b44f9e799792dac1396744c6c85250d458bea637b2de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.Process.dll","sha256":"91bdc3c21c68b64a3028b764de5f5e7cc0b711371a62f7bf528e7cdd88e07070","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"RWDetectCore.dll","sha256":"968536314e2a2f53e99a8cc0000a17192d07fb1cffe58f4eb515d8b730e063cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Serialization.Formatters.dll","sha256":"91d42614c9216da6c71de9c520050816fb233ef74984f7f11b81a7cdab48a529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Polly.dll","sha256":"f1bb9887719772d6460e66b30869d185e116449165a511f19fb346bffceed2fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Quic.dll","sha256":"202d70ac8c983a00f88192daabd27e3df73d9c860055fd5e99c8c27991c26756","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Collections.Concurrent.dll","sha256":"d2b2c64aafbd8bd34d30c3ab0e13839c9a5f7ae39ff8a78930c2c511287cc9e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Formats.Tar.dll","sha256":"20388763cd0a2a8d812ca420dfd85dd8c1c260ab34acb9d17244342df23cda02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Private.Uri.dll","sha256":"5d273653ca93c5cab35b5a08e5b26ea7ae260e93ee821decf7893c16e5217c49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Collections.dll","sha256":"97e567bcfde2a41ff28d7ff1d7b9498bcd986efc8594f3291414e5f540fe5b16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Polly.Core.dll","sha256":"a9c1c78b44571783b13ea78b96dd608c315f2e2da0dd48de45640498ce32f3f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Formats.Asn1.dll","sha256":"310c31605ed9c7982ca4d75746e404319cf1305b221fe89a3611d3bbbd6d304e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Http.dll","sha256":"ab0a94e7b23b9baa9fd2b4676ce902ea1dec033ccc3dcf708f8788758e15f37a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Primitives.dll","sha256":"df2c58de7897069086f0fd4fdee8ac902bb57ad94b656d47985f8d4e0f9495a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.AccessControl.dll","sha256":"2d608ffde5eb19faaa6a783706810ec95dcae9a833de4c1b104f1ca6742c7e05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.Http.dll","sha256":"0fa24d7da9b0189622ea983590d488b5e8473dac7eab76b34ab2268e4bed8f32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Xml.dll","sha256":"6c66ff454953fab6516a7269ac02726f7995677fc7b3b84d8635cc1a8e5e1513","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Runtime.Utilities.dll","sha256":"936bb6c8312bc828490cc0a2997b4d13c9caae45ebc00a0a85cb5b7b0bb179d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.NetFramingBase.dll","sha256":"9a7061b5102a252f6883cee596ce97b3dec4f7104287e88ee03712070fcfcc92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Mono.Unix.dll","sha256":"99bafdcab6e98708f76d6359c7b855994680385de3d6d2f0eb86d891f13074ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.Annotations.dll","sha256":"f2f9420e96f3eb4e77a30e110827e6d138b346b5af3c8e68f1034da0ddfa0daf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.CodeDom.dll","sha256":"be0fb6612acb0dec95ab01a47a4480114636f85c9ad3c6d13b566cc392b46ad5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.EventLog.dll","sha256":"7963020877590ce0955b570539f66930c11f60afa186aede0c1ed29db8aa5fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"SharpSnmpLib.dll","sha256":"0bbc7cf666d6078bbdd540ba5b9a5854069b5de15d99f9c103ce9e41f28a3406","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.WebSockets.dll","sha256":"641b546e6e96609fac1b7802cb1eed2e18dd5939a2dd22927b46a3213255b9dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Principal.Windows.dll","sha256":"a6b14c4777b2f1070291e033972bc3c5e8ea9b6136f4b1077e5d96f9cdd1ddc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Linq.Queryable.dll","sha256":"9ede458cfa281c88ebfe02e06b119ac9b5a163663c712c06fb73cc9f70c06d5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Console.dll","sha256":"497d5d289973345f6a0dc212b714b9ba74e429e72eb4fe3d63d3422b8b6c4931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"DnsClient.dll","sha256":"fcf2d07f01bb34f6e8ea61da6d281d1979b5d3c1485bcc5b2b350ec8c59cc2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"microsoft.management.infrastructure.native.dll","sha256":"e086f284fa886680761612c5d1e017f56c4d8227f69ef52cd6eede1c5d96523b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Pipes.dll","sha256":"a8532e68bcf3488ba94caedafe7ba008bc366b7ee4630ff781401465082704b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.WebClient.dll","sha256":"cc1fb4ba1c50de12d03a172117e71fb390a43f8c1cb4a737e00770406ccafd89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Memory.dll","sha256":"16bb6f554da5f82fb3cfe6b09ae8db11f089e9f0f201b3ac2abcc817e0b57beb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.NetworkInformation.dll","sha256":"cadea0de68d6860a860f518abcc8fc23925f954410f25f1188a4fb974348dcc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.PerformanceCounter.dll","sha256":"49745831307937ef5ebe98fbc431eaefd3377549304cbf194fbac01564a4a8f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"mscorrc.dll","sha256":"43a6d1dd4c652be9c8fcfe6dddda75349472198bfcba48d79f03c8e879559abd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Json.Core.dll","sha256":"6b137fe466bc1821a955ea51ccba460f01a0a27a5200b3f4ee8af07cc059d2bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.TraceSource.dll","sha256":"b326ed64525edc3bf63a849fb0a8d9aebeaa84ef19299d832129ef7a9e2cd621","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Drawing.Primitives.dll","sha256":"277b30ae9d7755d7912aa77a830c8a5dd403864ba23209fc52bb9e59a9c2a161","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Emit.dll","sha256":"73111e3ae2b2216afa2cafdc5605477d475545820ab2ad6ae3e79afe20f03f8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.Encodings.Web.dll","sha256":"5d6759dffab29f225ca69694182561783f3a048c22146a7a34fd120a7b45f98a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"microsoft.management.infrastructure.dll","sha256":"8a0dffa7fef0a09f49afd46eee3d0f1007e08e07ce300e58f6a73730de14b1d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"AEMAgent.exe","sha256":"19cb789162226cc0ddbe48ae43401c8a6f7a2be5fdc8aef2299388e0fdc932d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Tasks.Parallel.dll","sha256":"e49e67f23964be987cf57b5f2c0641e6904743d1ad648b538d3d7a64e8185d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Channels.dll","sha256":"9ce1c9d1793c5b8d8fd11baa92ccd92c8ceed45dbc5983b9a52743d3e8582864","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Http.Json.dll","sha256":"39c090a53417a9021d9324b65fc081e5cf92643da09a0911fd4d0baba9fdd6bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Csv.Core.dll","sha256":"0cc9b99b5f727424b48e9641d81afc5515c1159940555ac893793a225ff0709e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Win32.Registry.dll","sha256":"71fdf86301b1338703a3ffa5d0db3402575df33d87c5cd58e55f742f8c88e742","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"netstandard.dll","sha256":"557d57640492ef8070b2723f8a8e206d5142b2efdf4db484d2db2b0322b6c2dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.NameResolution.dll","sha256":"bf2370ba5adf96927e27b20cb23bc5b8b1e3ecdc5dded1d2a6a78af017b892c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.Xml.Core.dll","sha256":"aa01226007a3d0f0e490deba650aea72f5bacb3e8ec2d0dc327cd007626c2642","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.FileSystem.AccessControl.dll","sha256":"8846e05ec9cda944d0ee0d05b4e9181a0043a1324c607fc06ac8fac401f57191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Bcl.Cryptography.dll","sha256":"e80bdf71152a8cc3b1ae5891f2300fff3f0462dae8d2614e6199c8c2d2995a65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.WorldBank.Core.dll","sha256":"dfbb7ea80876909c35682d16b755ddeb96ae6c4b3b5be18f063f8080921906c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.WebSockets.Client.dll","sha256":"a48ee22a973ad47b5e232f3f09396e75db94df2b0cf6336610d1cf0dd55437d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Collections.NonGeneric.dll","sha256":"c173499f86c4e1ced2cd51bcf2b3abbf981d4de6d3b121788184b4d39babead3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Claims.dll","sha256":"c4a1375721b3a571f594584f52f7aed3c4260f98c0e6ebc4338ea24a0001c090","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Collections.Specialized.dll","sha256":"ec529c548c9d6a367af77f82b7fa6b65207c14cc45945197476f116c67037780","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceProcess.ServiceController.dll","sha256":"9d4c84daf9d68eba4f1f2a904977ea93b12f9f18dbe294c4a1a0cfde335a41ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.InteropServices.dll","sha256":"78409c2e6252960df681a4115bf4b9c3ae2909b97d1a112009b4542e1cfa429f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.Ping.dll","sha256":"150c5d97196a7ade0fbc9b556feea30962016d2155aa018a59e62462a88afdc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.IsolatedStorage.dll","sha256":"fa1b7551108d0bba86f83ff253caa486b7b2186aade4fa920a546e67d1e9a4db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.dll","sha256":"88225b23ffd77e5309f7a7d4982190a9446e50082fca8cbaf3899279757ea24c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Pipelines.dll","sha256":"ccd61dc503d1a87b18ff86dd09ca91734834f1cc0d74869afb2de305ea17d61d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.MemoryMappedFiles.dll","sha256":"91caebbe29b2e625316b580ba9597f6f89797aa8cad80da895649a734d788bad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.Primitives.dll","sha256":"f1b792d02d88f25037423958574a6935eb7a9d203a25d89278c123f26b0b2d69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.FileSystem.Watcher.dll","sha256":"17761ddf29ec3d0a3fc45ae2881dad2507060ed0d787eb2bb161f33e217aac29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.DispatchProxy.dll","sha256":"80ee51108efe70ccef0dd43937f1d5d4df291d7255a0fa0cf9994863eb41c98d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ObjectModel.dll","sha256":"bbf818b8c45890795d42a6dc231ed5a3d20b8a3b2ad3817553f69cbe83706553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.TextWriterTraceListener.dll","sha256":"536fb6e7cd7a24f48a7eeca3989b0d4407380e7adfbc6de684ee41f3d8e67b7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.WebHeaderCollection.dll","sha256":"574209c66245dfca752aea910007b14779a486d1ebdddd0edfcfb08639db354d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.NetTcp.dll","sha256":"3ef2c1ddc987d3050238bc6660f463be97f4f73a41d7e1d6990c1dcb81aa7918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Web.HttpUtility.dll","sha256":"409c2899193f26f2f67da5561f6948493952383a6bc42f2a5973ce092d7cd3e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Win32.SystemEvents.dll","sha256":"9ea03a93e2820d01a64faa8e301de331c9664a111a9f06d317b7ff3e3d537975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.FileSystem.DriveInfo.dll","sha256":"4c23a5ef9b3596191f2e883443add8b084c84dcee324c62ac01469f198622414","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Resources.Writer.dll","sha256":"9de2398385842106c5f1cca8d46d7d053feb9a9596e92664a5c43c549270b43a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.InteropServices.JavaScript.dll","sha256":"4519df347b6f56a391caca43d93a6da93c9778ba8160caf348a9084b2aadf478","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.FileVersionInfo.dll","sha256":"6f45a3df4defa17da92f6c9705bc5a64d4ec9379adfbdce68f1789e1e9283f26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.EventBasedAsync.dll","sha256":"2799b455376626501f76d020634513a3e52c43ae303e26f4afe54f485e45a3bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.TypeExtensions.dll","sha256":"1cc570c9fe1b1fd9969fb2048e0e8e5567429cd975488f57f3820eedfeb2c76b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.StackTrace.dll","sha256":"22cb0a817a121663b3f201a474017bb6f35edcb0a600a03a29c94c8c02cc8133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.ServicePoint.dll","sha256":"1ce48149b0fd3243eda031ce056a6289d224be3eb23a04a291167da3a3903ff1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.WebProxy.dll","sha256":"47c3e3fc6b5918e89f9a24e17840191d20bad4553612cfa8891363f1e9930086","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Serialization.Primitives.dll","sha256":"3eed2332ee423097f0e7222deb7797107b170529a5d765af21d85b2cf6f06be9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.ProtectedData.dll","sha256":"0ef416e3666a00e5a5bfe677479e7eb5de2fa0f1705e23c57577bffdafa35031","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.XPath.XDocument.dll","sha256":"b42db853f2aa0ac27ce7591a43ce91eb785c6dff15f8c2f500f3feceafe7018e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.dll","sha256":"883329b4bd6c23105f0037c3ea9956b30b53b76b3b1463ce00ae621686f8d3e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.CompilerServices.VisualC.dll","sha256":"a1cca73dee3bfa5f2df91440290752d555bd16e99d1fc551ac518ae7f7752451","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Extensions.ObjectPool.dll","sha256":"f208e98fd4c9477d61c5badfa11e63d7379a4787dbceffeabe35ca83aa8f19cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.ReaderWriter.dll","sha256":"22f33eb6b2923928602648d5d762cd18dd0b6874c949a8e696fcf659fe2ba9c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Drawing.dll","sha256":"a01280849c49f2688d74d09f0c3a35e3bae13a10df55e7a7e1a2933db953af42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Configuration.dll","sha256":"ebfbc11c754f5d14590baed9950422bfad323acd9fab7d1593d081358452d4c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Bcl.AsyncInterfaces.dll","sha256":"444520a2437efcc55a0adcc59c7b79c15c14e5c32fe6496687e0776661ebc5d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.dll","sha256":"a481b884f50aea4edf612aaf63f93b1ae3b2dbcc1fd036aa15d25696582605bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.XmlSerializer.dll","sha256":"ddbb9c85383bc4a2a807d670902f8ea1639d38b566fcbb63815e4d9e050f8561","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Extensions.dll","sha256":"faa3d7d10d9b202a0d1be27730ea9279c244f1cee053de8cc94f30f8ea771e87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Net.dll","sha256":"35814d2c99afca9991bca7772f7525864cb9fefb906bc9399d79d0fbbdf561b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Algorithms.dll","sha256":"360b1f2df041cc81fa9ee36c7e26308698631d7627e65feb73e8f927a9f3048b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.VisualBasic.dll","sha256":"729d61b00222000a51b7fd29737897a8c9615aed5726bfa1c4a1a7991f427855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Serialization.Xml.dll","sha256":"fd482849f95ffb353d9a26b914fb07e2d9f86f414024a10e73e9c1095c564bd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Intrinsics.dll","sha256":"a2a66a4cfa45a48d72d857cd8350b06e4e71b958e76eac597830dd7f02a26265","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.X509Certificates.dll","sha256":"72056cb13bd38eddfcc6ec7cb8d6170230d7a2c599db91d8a90c0307cbff4df8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.Web.dll","sha256":"87541dd838f775a4f3226ea72a0886aee6437ff63bb7728f6a941b8b337561cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ComponentModel.DataAnnotations.dll","sha256":"be6a27f144c544045fe4bf25684c761884565ed7fd52eaaec35a8f3b1a905229","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.Security.dll","sha256":"0d1336b177798ac63c13e0b22acd40cb16199bb255eddf7c1c1dea12660a85f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"WindowsBase.dll","sha256":"edd76d7f10fa98355f2a03b4c1e29711d18d43a6930955c387a20201f7746cfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Dynamic.Runtime.dll","sha256":"1c0b6faf611209db9515056b215f036fbed452c45e9f3d6c1da9b0adb95ec708","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.dll","sha256":"d9f2fe0b41902038b70989adf90f9ae38be3e2d6765562de1748d48c72256cb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Cng.dll","sha256":"4a567868bb2b9873f4550a26704c3213ca38100c70ea0f6b582a77a849fa8c6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.Tracing.dll","sha256":"cb2575d3390e7b84f72b88bcd6c35f277ad4bfb8f92aecef22ad5d677fba3773","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.Contracts.dll","sha256":"b3786ad08edb009a17585d984a5b91939926e0364f697346ef2969c5ca3267c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Pipes.AccessControl.dll","sha256":"7f9ee9516c8c01c0429e53ec283c3d1941a3fbbf4111d6feebddf2c8e89a6880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.XmlDocument.dll","sha256":"b30c8f2ad722ebd33280c5b58ce91c6fdb26298e85f7af7ca005dc3fd8121f5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Emit.Lightweight.dll","sha256":"76bec345015cf027e9ccc7a283f9014502bab807e98fb73baf807abac78cb531","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Numerics.Vectors.dll","sha256":"783d1aa44d9f63b732e391ace05f8191b82ebad23056926ae28e5199d74fd2ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Primitives.dll","sha256":"4c7ed6a058e26cec9bb4ee07823433fec11261c5d36de8962fe7bdd07b4018ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Primitives.dll","sha256":"4039ef85a3dd148512665001cb0b6cd8b9cc5c33e1cbde60e4c24026ec9600c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Overlapped.dll","sha256":"24088c28885590f0a5afe01fe73f03e6ab6d3905f09f064e0d9fb1ae843d3b2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Windows.dll","sha256":"a43d250f01fd26c6ae0d6b3e4cde718e077e53f701df84ebe6c2fb9a4d5ced40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Thread.dll","sha256":"f0f904c85e7dfca7607ff63558bae525b0664d5b2b763b16405542de93e4aaf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Csp.dll","sha256":"0b4b57a55b3c2efb3b5b702095468b557dd15be611263df79c989d73b4605306","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Emit.ILGeneration.dll","sha256":"3dce9512725923c0f88e6ab2ca1095e0bb57bbf770e53fee0d56c98cd8202982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.Debug.dll","sha256":"15609f134d1eab5c65a90bc5218fec7c2b09a7cc33fea3112bb77af6d7e56e4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.XPath.dll","sha256":"6758a6967814485e714ee9599550a1f0abb5ab2b0ae4b244c877e2c7c96799b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.Encoding.dll","sha256":"4a2f23ccdb49cb88208a5f9f954d29c629a525ab312089475935a909c2fba067","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Globalization.Calendars.dll","sha256":"2b7bd01bedbc876d4748126670829a298e92446d4be8cbc86bb967299c435125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Loader.dll","sha256":"003981491304b5025eb7f440781a4fa943491fc5f96ec26786bbd510b3ba5155","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.ThreadPool.dll","sha256":"312a92ae8226e1a3b9dc5ffd23f9acd6272a022dfec3c8582840c916651f7dd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.Encoding.dll","sha256":"d30f01413cabbab8d260a97ef8d430de5ae4d440f1b8dcf361e38e60c524896b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.XDocument.dll","sha256":"f9a761f41a99cded38d178708556ea662e64b1d479450b733eefb7141a8a2a41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Resources.ResourceManager.dll","sha256":"563053522619e15d9d5a06a902791cc8654911aff06c306fd781ab3a95c0acbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Globalization.dll","sha256":"f340cd44ba8026bb855eecc3c3ca36808f6ff1b081cdf3f2f45947354599ce3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Serialization.Json.dll","sha256":"a651dc4da5d2d34565f9dc8bc294a29219bf484b6114b5e2407c7462d36e1b80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Text.Encoding.Extensions.dll","sha256":"58e53f66f52425502d5bea0aa181c600d79b968eec5de9d2e92d053993089ebe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.FileSystem.dll","sha256":"16891a74c30c4583a2a4b74bbe568c0877fc1f99caf4bdb3b107293dba81a0eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Tasks.Extensions.dll","sha256":"8a42cfd667c1f176ef3ed20b696a355ff00176331cb2291c344df94eea5ebb2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceProcess.dll","sha256":"44570953d999da011edcc27e48c01f82d3511e0a2e06e6bf659c3fa9a1605c6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Reflection.Extensions.dll","sha256":"359813a47859dc7a7d1ad7d378aec89cd64771648b4ed57aebc5db7d0a9f722b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.AppContext.dll","sha256":"ad2f215dfdfd3e81985a25b5bbba093797fe33ebebc5d3ac3696e3f8fd24c54b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.InteropServices.RuntimeInformation.dll","sha256":"54047425f8259ceb7ba8f4e7fc06a33c9e4df17b1e61926c192fe8d765c55a45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.FileSystem.Primitives.dll","sha256":"c806328a2e3932d7343a6db0554f06f21801c04f867f560b42e4694fe8c2b58e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.CompilerServices.Unsafe.dll","sha256":"199c3b66dff5e1846054e34d7edcf9aac1f9ae8d9c1959cea3557b15883fe65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Resources.Reader.dll","sha256":"df56495293942e847b1f452ec2807433261e4890a5dd1ef5d766c6e615d52166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.SecureString.dll","sha256":"22db46c60c9d33edd31aeff4922c4bf8ad6d0d7e9d876cea59716b80263e0f52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Handles.dll","sha256":"34c2460eb957cd7aca1f6691dc43775ebc02acdc7bd76d3404d46349362d2cdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Buffers.dll","sha256":"ae992fb3b9737226acc603f13ab59a48ea3233d663593952f6b2993374a7be55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Threading.Timer.dll","sha256":"40bb6e5a9e8741f8cc810d0601706c504ced7310f8d67873b71c64379e339aee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Microsoft.Win32.Primitives.dll","sha256":"632e3a3e8b4ff95e76c93a2413bc50601f72ce21d86c758c5f978c72734132d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Globalization.Extensions.dll","sha256":"18471dd944a4e8c6bb2b3967d535045d94107ff54694eb9970464d2d2e4d7363","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Principal.dll","sha256":"fd523b1959693cdd304048e409f5580b2cd1165d7596b452fcdc98a14525369c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Diagnostics.Tools.dll","sha256":"bd14b0ba66a22ad063b339f933eeb2e2f468332166842593f7db7c768e07077e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Web.dll","sha256":"fa32008761f51abe45ed2d4ad47a8f05ed4f0a4e8834419ac456dcf0a156af97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ValueTuple.dll","sha256":"fc22e13691024375a512bb4bb9f7d57f295904f462fca6cb7553ed4ffb28f11e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Security.Cryptography.OpenSsl.dll","sha256":"10c69e71f1093211a76fa863082f6420dc33b78bde7d8d665f031c22eb20d31c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.UnmanagedMemoryStream.dll","sha256":"7ff72338d91215da07e94f4544634c0c8c0421116222b0c7cb407c27749ecd44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.Duplex.dll","sha256":"8cde3443ef4d0360d7d392a353d91b1270ded64345e3ccf611e152d4b25a9978","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Polly.Contrib.WaitAndRetry.dll","sha256":"3fb02f7cb4c122998cfca8931ea8477396cfe664107bbd7eb794438a4bd4a11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Data.dll","sha256":"11c4067a6ebd43a56201705d443d2cd82735734a3c05eddfc0a80143a73740dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"nsProcess.dll","sha256":"95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"nsSCM.dll","sha256":"0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Private.Xml.dll","sha256":"88e8c3c8087711f19043fc80d6b0948c9aaee10df5e1c9b3f81c24ee3db4e52b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FsToolkit.ErrorHandling.dll","sha256":"af962da6e18d8d136c8644c652698d3fd5bb72ae7fa32742a2f0dff40f8f4643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"msquic.dll","sha256":"f7f1fed9faa50b4ded05b9c0dea93d4be319e6ffc7c35f8864667de5ec28a2a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"clrgc.dll","sha256":"9ad461deca9525ae725bf25143c7a36ac89de18f17e805074e9906dcfec5fc01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Control.Reactive.dll","sha256":"da784da553237ccc1fe66690084b7c3147aa0bc3a05fe9e753c0249f8ed300cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"hostpolicy.dll","sha256":"7200b8ccf22448bb68d04eb30cc01b3bb04e7a502f3b62456af6084aa8952650","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FSharp.Control.AsyncSeq.dll","sha256":"a030ab4cc13707b4ef1b4b832a97c69391f091a7406b6910732c7c00aebd17e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"hostfxr.dll","sha256":"e58d77b12b2099cde55793efc0d88eaf5aa9108296d860a78e6a28eed72cb633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Compression.dll","sha256":"e61ef96bb85dee4ad2e26a840b3f9aa6e2bc99d52c0310c7c6e04603ae7001c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FParsec.dll","sha256":"147154cd8e33699c1458cd7653b78d6c93c2ea272e9aeb3f838af95af2a82b23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"dotnet.exe","sha256":"8983dc083d0248a6838336ec988cf3f6abd9ba7d7799a6026a38501afda7d94c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"FParsecCS.dll","sha256":"1822de41fcf78bf92de841f03e9a5c78db7fb1eb19cf699f78e06f064e0d4013","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Compression.Brotli.dll","sha256":"ddf3dce1a06c513db8c3438c73aad934284db99e01aad140d66f5ce51d68d092","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"createdump.exe","sha256":"a35b0cbbd550f565ea71c5016bfe0d228a1c68020dc2e065a911512ab54675b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"mscorlib.dll","sha256":"3eb92ecfaf7ce3cc6e11c8151894a5813bbc0004f11973aef0ef6cb3e8190420","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Compression.ZipFile.dll","sha256":"cf6f58c936fb05b7b10139353cd4bd7dee46b54f7e5c7524493a2e2c7443084d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Cronos.dll","sha256":"418e7ae68059da51130b5dfe93a1b2660e92e391a0ec41df8a0b001739a850b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Tommy.dll","sha256":"99cdf4436427aa99fed43d4dd6b57755fb3285fe07fe648dfcadadae3763c2ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Data.dll","sha256":"8eadb7c38128e7fa43a8940bbc9bf51004c03d219bd629b158744d9e40666bc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.ServiceModel.dll","sha256":"7b25feeecf406c6fd00fea3be98e5b0173506da4749b67010fd47ebdc5b05d4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"microsoft.management.infrastructure.native.unmanaged.dll","sha256":"8fef324494e8cb23d6f428525b307fa68f6bdfabe49ec15f28fc766e2fc40e7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Core.dll","sha256":"36d99516b069f0b45562199d60f94b6e6620d5e610a69375c25b5d887afe2ce9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.dll","sha256":"3585aa4806fe8f2809529e01f3022c26bb2a7e83b2ae6c0d429ecc35d7cf96b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Runtime.Serialization.dll","sha256":"5882eb8e77b90da765d6996652643d43788dc4ec13a3d77648b23ca121bcbee6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.Serialization.dll","sha256":"db4aba2c78a105224145d93313d66b0733b712281854a200f5974e7b70dd8764","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Transactions.dll","sha256":"8a15c9db62a0fd6fe5cd134c367aab5be3ef85436b07a4a2f050ad767320875e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Xml.Linq.dll","sha256":"8962089c82c4ac31e3a11e1c9809b7a345356a26752ed85dc19e37ffafd01dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Data.DataSetExtensions.dll","sha256":"44a4d4243a1a4c9399c17f3a5c619e50e4bf49a8e7ce12af482c001ae4e1cadc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.IO.Compression.FileSystem.dll","sha256":"98299f030b646a8aa7a849df0cc31d9604d0007e4f00d51aa839143f3ec7d61d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"System.Numerics.dll","sha256":"7047b06fd8a10e3a4a4563d44777eb91069475218bef16263122af936a9a8007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsf54A5.tmp","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%TEMP%\\nsv5504.tmp","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsv5504.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\CSIcon.ico","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\defaultbrand.zip","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\AxInterop.MSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\AxInterop.ViewerX.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\CagService.exe","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\CagService.exe.config","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Common.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Core.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Core.XmlSerializers.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\FSharp.Core.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\FsLexYacc.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Gui.exe","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Gui.exe.config","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\ICSharpCode.SharpZipLib.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Microsoft.Threading.Tasks.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Microsoft.Threading.Tasks.Extensions.Desktop.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Microsoft.Threading.Tasks.Extensions.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Newtonsoft.Json.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\nlog.config","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\NLog.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Snmp.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\SnmpSharpNet.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\System.IO.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\System.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\System.Threading.Tasks.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Transitions.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\WeifenLuo.WinFormsUI.Docking.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Interop.MSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\scvncctrl.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Interop.ViewerX.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\WindowsAgent.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Microsoft.Web.Services3.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\CsExec.Service.exe","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\putty.exe","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Licenses.txt","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Vim25Service.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\Vim25Service.XmlSerializers.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\uninst.exe","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\es\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\de\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\fr\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\it\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\pt\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\sv\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\hu\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%PROGRAMFILES%\\(x86)\\CentraStage\\nl\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%TEMP%\\nsv5504.tmp\\nsisXML.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\CentraStage\\Agent Monitor.lnk","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\CentraStage\\Agent Browser.lnk","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\CentraStage\\Uninstall Agent.lnk","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"},{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsv5504.tmp\\SimpleFC.dll","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nso77EE.tmp","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\CSIcon.ico","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\defaultbrand.zip","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\AxInterop.MSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\AxInterop.ViewerX.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\CagService.exe","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\CagService.exe.config","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Common.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Core.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Core.XmlSerializers.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\FSharp.Core.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\FsLexYacc.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Gui.exe","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Gui.exe.config","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\ICSharpCode.SharpZipLib.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Microsoft.Threading.Tasks.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Microsoft.Threading.Tasks.Extensions.Desktop.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Microsoft.Threading.Tasks.Extensions.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Newtonsoft.Json.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\nlog.config","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\NLog.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Snmp.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\SnmpSharpNet.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\System.IO.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\System.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\System.Threading.Tasks.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Transitions.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\WeifenLuo.WinFormsUI.Docking.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Interop.MSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\scvncctrl.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Interop.ViewerX.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\WindowsAgent.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Microsoft.Web.Services3.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\CsExec.Service.exe","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\putty.exe","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Licenses.txt","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Vim25Service.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\Vim25Service.XmlSerializers.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\uninst.exe","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\es\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\de\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\fr\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\it\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\pt\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\sv\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\hu\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\nl\\Gui.resources.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\nsisXML.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\SimpleFC.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\nsProcess.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\nsSCM.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%TEMP%\\nsj781E.tmp\\SimpleSC.dll","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C56C4404C4DEF0DC88E5FCD9F09CB2F1","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C56C4404C4DEF0DC88E5FCD9F09CB2F1","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_C5EB5A18462AEFA298CA0164DD86D4B7","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_C5EB5A18462AEFA298CA0164DD86D4B7","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BA74182F76F15A9CF514DEF352303C95","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BA74182F76F15A9CF514DEF352303C95","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1A374813EDB1A6631387E414D3E73232","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1A374813EDB1A6631387E414D3E73232","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%PROGRAMFILES%\\CentraStage\\log.txt","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\rmikt0ne.tmp","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\rmikt0ne.newcfg","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\y0gzu5eb.tmp","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\y0gzu5eb.newcfg","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\515ymxcm.tmp","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"path":"%LOCALAPPDATA%\\CentraStage\\Gui.exe_Url_33hwrkwg2o3hktxw2gdopazh3gomuuhh\\4.4.10748.10748\\515ymxcm.newcfg","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7328:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7328:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"Local\\SM0:7328:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"SM0:7328:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69a629334f3852fed70d9e50"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\NLog-FileFileArchiveLock-c:_program files_centrastage_log.txt","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\b7a871fc-9dbe-42ab-a549-b92483af7a34","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Global\\NLog-FileFileArchiveLock-c:_program files_centrastage_log.txt","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]},{"name":"b7a871fc-9dbe-42ab-a549-b92483af7a34","sources":[{"report_type":"sandbox","report_id":"69a61e164a103c680407bae3"}]}]}},"report_ids":{"sandbox_job_ids":["69a629334f3852fed70d9e50","69a61e164a103c680407bae3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 5d655af0cacc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5d655af0cacc…. Threat score 100/100. 0/0 AV engines flagged this file. 4 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 5d655af0cacc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5d655af0cacc…. Threat score 100/100. 0/0 AV engines flagged this file. 4 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d655af0cacc81c86d4f2e55adcbde7e13a8619fcbd4ae70ccdde0b5060f11cf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 5d655af0cacc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5d655af0cacc…. Threat score 100/100. 0/0 AV engines flagged this file. 4 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]