%s

25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T2aae,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")27:T7dc,"WACUP_Preview_v1_99_56_25346_x64.exe" called "FindResourceW" with parameter "110" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "FindResourceW" with parameter "132" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "FindResourceW" with parameter "187" - (UID: 00000000-00002044) "wacup.exe" called "FindResourceW" with parameter "616" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "126" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "127" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "128" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "129" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "130" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "132" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "133" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "134" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "135" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "150" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "197" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "194" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "231" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "249" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "199" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "1337" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "252" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "285" - (UID: 00000000-00007508) "wacup.exe" called "FindResourceW" with parameter "169" - (UID: 00000000-00007508)28:Tc56,"WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadResource with parameter {'hModule': '140722765758464', 'hResInfo': '140722767381728'}" (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadResource with parameter {'hModule': '140722765758464', 'hResInfo': '140722767381744'}" (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadResource with parameter {'hModule': '140722765758464', 'hResInfo': '140722767381920'}" (UID: 00000000-00002044) "wacup.exe" called "LoadResource with parameter {'hModule': '140722765758464', 'hResInfo': '140722767384064'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637568'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637584'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637600'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637616'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637632'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637648'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637664'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637680'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637696'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637712'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637760'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637744'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637792'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637824'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637776'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637888'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637856'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '140722572689408', 'hResInfo': '140722572986536'}" (UID: 00000000-00007508) "wacup.exe" called "LoadResource with parameter {'hModule': '2599331627008', 'hResInfo': '2599331637728'}" (UID: 00000000-00007508)29:Tddd,Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-40-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithSHA1And2-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-128" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithSHA1And128BitRC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-40" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithSHA1And40BitRC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "RC2-64-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "PBE-MD2-RC2-64" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; Source: "00000000-00002044.00000003.255773.8563E000.00000002.mdmp")2a:Tce2,"WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\INPROCHANDLER") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\INPROCHANDLER") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LOCALSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LOCALSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LOCALSERVER") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LOCALSERVER") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\ELEVATION") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\ELEVATION") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\PROGID") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\PROGID") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\PROGID") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\PROGID") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\INPROCSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\INPROCSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\AUTOCOMPLETE\CLIENT\") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\AUTOCOMPLETE\CLIENT") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\INPROCSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\INPROCSERVER32")2b:T802,"WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2585422729 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2585428839 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2585604228 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2585614028 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2586355046 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2586361479 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2659011300 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2659018374 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2659147584 [PID: 2044] "WACUP_Preview_v1_99_56_25346_x64.exe" queried SystemProcessInformation at 00000000-00002044-00000C15-2659154613 [PID: 2044] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2672119828 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2672126387 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2672316064 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2672322190 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2675439197 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2675446054 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2677887411 [PID: 7508] "wacup.exe" queried SystemProcessInformation at 00000000-00007508-00000C15-2677894112 [PID: 7508]2c:T479,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm2d:Tc932,Found XOR loop in file "libcurl.dll" at offset 401820; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 766226; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 766347; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 766495; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2030348; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2314956; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2489494; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2610880; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2793893; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 2962852; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 3101540; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 3651136; code bytes = 30d0 Found XOR loop in file "libcurl.dll" at offset 472862; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 497333; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 531319; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 531324; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 534473; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 534478; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 629350; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 629357; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 661497; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 662441; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 662481; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 663585; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 663620; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 663625; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 664058; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 664095; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 664100; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 683175; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 683180; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 706066; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 810433; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1084217; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1213939; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1214615; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1229717; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1351811; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1351913; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1414724; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660631; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660645; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660697; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660806; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660845; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1660859; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1662240; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1662252; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1662262; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1666876; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1666942; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1671799; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1671813; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1671868; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1671977; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1672016; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1672030; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1674857; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1674878; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1674914; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1683221; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1683451; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1683681; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1683911; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1684141; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1684374; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1684623; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1695135; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1695322; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1695764; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1695846; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1696398; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1696441; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1696734; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1696785; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1697430; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1697617; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1697921; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698031; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698115; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698118; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698678; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698728; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1698800; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1711428; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1719296; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1720995; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1721002; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1721011; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1721113; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1721116; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1724987; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1725003; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1725820; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1725839; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1725913; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1725938; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1726013; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1726065; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1726153; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1726194; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1729996; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1730160; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1730267; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1733253; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1733336; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1733616; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1733699; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1733998; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734099; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734113; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734166; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734225; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734275; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734287; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734341; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734397; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734443; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734462; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734518; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734581; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734628; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734644; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734688; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734789; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734861; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1734958; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735024; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735135; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735201; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735264; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735270; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735329; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735334; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735398; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735431; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735437; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735497; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735502; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735608; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735614; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735667; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735672; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735824; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735932; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1735999; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736122; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736190; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736410; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736492; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736552; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736666; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736738; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736841; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736939; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1736944; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737055; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737061; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737119; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737124; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737230; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737236; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737293; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737298; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737407; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737413; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737512; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737623; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737689; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737804; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737865; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1737977; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738029; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738044; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738142; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738156; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738217; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738227; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738306; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738374; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738508; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738557; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738604; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738624; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738650; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738702; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738732; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738752; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738778; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1738826; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1741280; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1741501; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1741748; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1742013; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1742266; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1742519; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1742779; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1743027; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1743264; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1743507; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1743736; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1743977; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1744220; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1744460; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1744709; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1744960; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745208; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745463; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745516; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745720; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745726; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1745969; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1746230; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1746475; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1746727; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1746987; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1747971; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1748072; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1748224; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1748250; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1748721; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1748980; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1749245; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1749494; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1749727; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1753377; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1753390; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1851420; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 1851557; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2075358; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2096912; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2112818; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2112821; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2126624; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2126634; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2155331; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2155371; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2155637; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2155643; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2301449; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2464195; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2466675; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2795564; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 2975549; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 3143952; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 3155499; code bytes = 33c1 Found XOR loop in file "libcurl.dll" at offset 789149; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 804688; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 1546155; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 1995084; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 1998572; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2079595; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2242450; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2309996; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2354271; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2483739; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2493784; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2502084; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2728920; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 2962972; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 3017195; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 3072874; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 3599632; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 3641944; code bytes = 8030 Found XOR loop in file "libcurl.dll" at offset 3673408; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 69024; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 424100; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 473131; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 473170; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 473230; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 473272; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 526524; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 876094; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 876101; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 921379; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 922402; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 923427; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 924450; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 925473; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 926470; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 972518; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 1063139; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 1940229; code bytes = 33c1 Found XOR loop in file "in_vgmstream.dll" at offset 667237; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 736544; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 789717; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 868264; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1070212; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1086616; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1146000; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1177926; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1203318; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1225201; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1236150; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1250342; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1253825; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1309729; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1319062; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1370742; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1386769; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1419809; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1461537; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1468678; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1487254; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1547926; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1554897; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1572977; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1580497; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1605409; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1620326; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1638061; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1678550; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1682033; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1685398; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1707062; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1784577; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1788310; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1818408; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1834248; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1921414; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1921422; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1952610; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 1953106; code bytes = 8030 Found XOR loop in file "in_vgmstream.dll" at offset 2156152; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 813348; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 814031; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 814556; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 819005; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1023212; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1339854; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1485652; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1529476; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1767696; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1828381; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1935443; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 1989112; code bytes = 30d0 Found XOR loop in file "wacup_helper.dll" at offset 137233; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 310527; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 310542; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 327939; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 327960; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 340377; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 542363; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 542375; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 569214; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 616769; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 799447; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 799726; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 802616; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 802649; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1309083; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1717284; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1790597; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1805392; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1953661; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 2058122; code bytes = 33c1 Found XOR loop in file "wacup_helper.dll" at offset 1478975; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 1531116; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 1573287; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 1573759; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 1574967; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 1575623; code bytes = 8030 Found XOR loop in file "wacup_helper.dll" at offset 2092468; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1143231; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1170983; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1176119; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1176391; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1183419; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1189495; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1190855; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1193495; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1195763; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1195807; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1195935; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1196011; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1196143; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1196251; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1196803; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1197423; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1197755; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1197795; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1198427; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1198471; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1204907; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1208339; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1208735; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211299; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211371; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211403; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211435; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211467; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 1211555; code bytes = 30d0 Found XOR loop in file "ucrtbase.dll" at offset 132529; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 310376; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 392323; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 392972; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 438428; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 438434; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 438479; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 563575; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 570558; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 602409; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 644744; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 666909; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 666916; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 666943; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 667014; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 682377; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 734825; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 834738; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 914359; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 914424; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 921511; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 1322612; code bytes = 33c1 Found XOR loop in file "ucrtbase.dll" at offset 1083171; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1117383; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1313832; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1354427; code bytes = 8030 Found XOR loop in file "ucrtbase.dll" at offset 1357943; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 87265; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 93011; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 237334; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 238351; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 293457; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 682108; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 892567; code bytes = 33c1 Found XOR loop in file "in_mod.dll" at offset 202; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 271524; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 271734; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 271851; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 324738; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 693257; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 795884; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 1102130; code bytes = 8030 Found XOR loop in file "in_mod.dll" at offset 1159187; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 562330; code bytes = 30d0 Found XOR loop in file "in_vermas.dll" at offset 80703; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 89358; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 120221; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 120884; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 135173; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 164861; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 164970; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 165233; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 198524; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 209812; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 209891; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 234297; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 234304; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 242587; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 242601; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 350861; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 386316; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 386321; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 386325; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 386330; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 386339; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 399904; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 438653; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 539439; code bytes = 33c1 Found XOR loop in file "in_vermas.dll" at offset 32928; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 107427; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 120574; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 146976; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 155762; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 224800; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 320357; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 361278; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 361853; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 362785; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 362845; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 376288; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 517703; code bytes = 8030 Found XOR loop in file "in_vermas.dll" at offset 568031; code bytes = 8030 Found XOR loop in file "in_psf.dll" at offset 143304; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 143592; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 210424; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 290048; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 313828; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 317472; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 358868; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 370324; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 449932; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 449940; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 449948; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 450056; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 450064; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 469441; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 498388; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 498616; code bytes = 30d0 Found XOR loop in file "in_psf.dll" at offset 3482; code bytes = 33c1 Found XOR loop in file "in_psf.dll" at offset 112479; code bytes = 33c1 Found XOR loop in file "in_psf.dll" at offset 137247; code bytes = 8030 Found XOR loop in file "in_psf.dll" at offset 236668; code bytes = 8030 Found XOR loop in file "in_2sf.dll" at offset 89856; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 90220; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 90596; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 90968; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 91358; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 92147; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 94789; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 95137; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 95513; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 95881; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 96271; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 96665; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 97060; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 97251; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 104231; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 104643; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 104655; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 105050; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 105062; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 107543; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 107955; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 107967; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 108362; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 108374; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 164689; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 197664; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 198028; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 198404; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 198776; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 199166; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 199955; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 202597; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 202945; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 203321; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 203689; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 204079; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 204473; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 204868; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 205059; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 212023; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 212435; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 212447; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 212842; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 212854; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 215335; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 215747; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 215759; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 216154; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 216166; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 299744; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 408415; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 430583; code bytes = 33c1 Found XOR loop in file "in_2sf.dll" at offset 411871; code bytes = 8030 Found XOR loop in file "in_2sf.dll" at offset 561255; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 37032; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 316659; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 316996; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 543045; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 553384; code bytes = 8030 Found XOR loop in file "in_sc68k.dll" at offset 271170; code bytes = 30d0 Found XOR loop in file "in_sc68k.dll" at offset 296786; code bytes = 30d0 Found XOR loop in file "in_sc68k.dll" at offset 41100; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 59984; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 158788; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 164003; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 206992; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 209057; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 221839; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 429120; code bytes = 33c1 Found XOR loop in file "in_sc68k.dll" at offset 37379; code bytes = 8030 Found XOR loop in file "in_sc68k.dll" at offset 114156; code bytes = 8030 Found XOR loop in file "in_sc68k.dll" at offset 277498; code bytes = 8030 Found XOR loop in file "in_sc68k.dll" at offset 517480; code bytes = 8030 Found XOR loop in file "in_sc68k.dll" at offset 517616; code bytes = 8030 Found XOR loop in file "tag2.dll" at offset 296; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 143477; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 384104; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 385209; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 408184; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 476672; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 482132; code bytes = 30d0 Found XOR loop in file "tag2.dll" at offset 246453; code bytes = 33c1 Found XOR loop in file "tag2.dll" at offset 379127; code bytes = 33c1 Found XOR loop in file "in_addanotherplug.dll" at offset 226593; code bytes = 30d0 Found XOR loop in file "in_addanotherplug.dll" at offset 298713; code bytes = 30d0 Found XOR loop in file "in_addanotherplug.dll" at offset 298875; code bytes = 30d0 Found XOR loop in file "in_addanotherplug.dll" at offset 19984; code bytes = 33c1 Found XOR loop in file "in_addanotherplug.dll" at offset 301808; code bytes = 33c1 Found XOR loop in file "in_addanotherplug.dll" at offset 332901; code bytes = 33c1 Found XOR loop in file "in_addanotherplug.dll" at offset 357663; code bytes = 33c1 Found XOR loop in file "enc_fdkaac.dll" at offset 245512; code bytes = 30d0 Found XOR loop in file "enc_fdkaac.dll" at offset 7120; code bytes = 33c1 Found XOR loop in file "enc_fdkaac.dll" at offset 308915; code bytes = 33c1 Found XOR loop in file "enc_fdkaac.dll" at offset 424484; code bytes = 33c1 Found XOR loop in file "enc_fdkaac.dll" at offset 12310; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 12836; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 343278; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 364950; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 369382; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 385286; code bytes = 8030 Found XOR loop in file "enc_fdkaac.dll" at offset 387942; code bytes = 8030 Found XOR loop in file "in_org.dll" at offset 8499; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 7547; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 98872; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 98888; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 98906; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 99158; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 99557; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 164197; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 322447; code bytes = 33c1 Found XOR loop in file "in_gsf.dll" at offset 217396; code bytes = 8030 Found XOR loop in file "in_gsf.dll" at offset 325967; code bytes = 8030 Found XOR loop in file "in_gsf.dll" at offset 397095; code bytes = 8030 Found XOR loop in file "ml_ll.dll" at offset 306581; code bytes = 30d0 Found XOR loop in file "ml_ll.dll" at offset 219719; code bytes = 33c1 Found XOR loop in file "ml_ll.dll" at offset 223447; code bytes = 8030 Found XOR loop in file "ml_ll.dll" at offset 269703; code bytes = 8030 Found XOR loop in file "ml_ll.dll" at offset 305489; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 173461; code bytes = 33c1 Found XOR loop in file "libsndfile.dll" at offset 271667; code bytes = 33c1 Found XOR loop in file "libsndfile.dll" at offset 296; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 1212; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 90581; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 138220; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 200445; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 277284; code bytes = 8030 Found XOR loop in file "libsndfile.dll" at offset 321940; code bytes = 8030 Found XOR loop in file "in_snsf.dll" at offset 37017; code bytes = 33c1 Found XOR loop in file "in_snsf.dll" at offset 38328; code bytes = 33c1 Found XOR loop in file "in_snsf.dll" at offset 96014; code bytes = 33c1 Found XOR loop in file "in_snsf.dll" at offset 121817; code bytes = 33c1 Found XOR loop in file "in_snsf.dll" at offset 226747; code bytes = 33c1 Found XOR loop in file "in_snsf.dll" at offset 89720; code bytes = 8030 Found XOR loop in file "in_snsf.dll" at offset 230711; code bytes = 8030 Found XOR loop in file "in_snsf.dll" at offset 275503; code bytes = 8030 Found XOR loop in file "out_neo.dll" at offset 197885; code bytes = 30d0 Found XOR loop in file "out_neo.dll" at offset 236448; code bytes = 30d0 Found XOR loop in file "out_neo.dll" at offset 240536; code bytes = 30d0 Found XOR loop in file "out_neo.dll" at offset 192603; code bytes = 33c1 Found XOR loop in file "out_neo.dll" at offset 249363; code bytes = 8030 Found XOR loop in file "in_usf2.dll" at offset 200077; code bytes = 30d0 Found XOR loop in file "in_usf2.dll" at offset 23647; code bytes = 33c1 Found XOR loop in file "in_usf2.dll" at offset 54944; code bytes = 33c1 Found XOR loop in file "in_usf2.dll" at offset 117367; code bytes = 33c1 Found XOR loop in file "in_usf2.dll" at offset 180100; code bytes = 33c1 Found XOR loop in file "in_usf2.dll" at offset 188931; code bytes = 33c1 Found XOR loop in file "in_sidious.dll" at offset 157492; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 158618; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 158684; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 177972; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 179098; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 179164; code bytes = 30d0 Found XOR loop in file "in_sidious.dll" at offset 105010; code bytes = 33c1 Found XOR loop in file "in_sidious.dll" at offset 133096; code bytes = 33c1 Found XOR loop in file "in_sidious.dll" at offset 133129; code bytes = 33c1 Found XOR loop in file "in_sidious.dll" at offset 137751; code bytes = 33c1 Found XOR loop in file "libfaad2.dll" at offset 102115; code bytes = 33c1 Found XOR loop in file "libfaad2.dll" at offset 165391; code bytes = 33c1 Found XOR loop in file "libfaad2.dll" at offset 167279; code bytes = 33c1 Found XOR loop in file "libfaad2.dll" at offset 139398; code bytes = 8030 Found XOR loop in file "in_msx.dll" at offset 81685; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 81740; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 93808; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 96213; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 97294; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 100333; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 103443; code bytes = 33c1 Found XOR loop in file "in_msx.dll" at offset 175285; code bytes = 8030 Found XOR loop in file "unrar.dll" at offset 32806; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 32890; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 32974; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 33093; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 33248; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 118976; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 121337; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 121615; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 121667; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 122009; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 122100; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 122942; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 123082; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 123099; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 123212; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 136107; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 136468; code bytes = 33c1 Found XOR loop in file "unrar.dll" at offset 179523; code bytes = 33c1 Found XOR loop in file "in_ncsf.dll" at offset 137983; code bytes = 33c1 Found XOR loop in file "in_ncsf.dll" at offset 153447; code bytes = 33c1 Found XOR loop in file "in_ncsf.dll" at offset 141655; code bytes = 8030 Found XOR loop in file "in_ncsf.dll" at offset 183727; code bytes = 80302e:T4eb,file/memory contains long string with (Indicator: "github.com"; File: "in_url.dll") file/memory contains long string with (Indicator: "github.com"; File: "license.rtf") file/memory contains long string with (Indicator: "youtube.com"; File: "patreons.rtf") Found string "youtube.com" (Indicator: "youtube.com"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found string "%sgithub.com/%s/%s/releases/latest/download/%s%s%s%s" (Indicator: "github.com"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found string "%sgithub.com/%s/%s/%s/%s/%s/%s_%s_%s_%s%s" (Indicator: "github.com"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found string "%sgithub.com/%s/%s/%s/%s/%s/%s_win%d%s" (Indicator: "github.com"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found string "www.paypal.com" (Indicator: "paypal.com"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp")2f:T608,"WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "Welcome to the WACUP (64-bit) setup - this won't take long ^_^" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "WACUP is an independent project by those who care about keeping the 'classic' Winamp experience alive && want to use something tha" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "Released in memory of Matt Auckland (forever thankful for the encouragement && the music), Kenneth Owen && Fannie G Smith who al" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "Choose Install Mode" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "Choose the type of WACUP (64-bit) installation required." - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" with parameter "WACUP 1.99.56 Build 25346 -- Built on 23/10/2026 at 00:29:37" - (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetWindowTextW" (UID: 00000000-00002044)30:T214e,"WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000002b000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a4400400100000000203d00000000000000000000000000d8ff5f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070cc93acfc7f00007f0200000000000000000000000000000000000000000000801f0000ffff00000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000007b6307aafc7f000003000000000000000000000000000000050000000000000040884c91fc7f000050f05f0000000000bb5f71aafc7f00009bd455f720b9000040884c91fc7f00000500000000000000000000000000000040884c91fc7f00001c5b71aafc7f0000000000000000000005000000000000000d000000000000000d0000000000000006000000000000001af54791fc7f0000a0234891fc7f00000000000000000000f8004791fc7f0000144c90acfc7f000060a34b91fc7f00003df54791fc7f00000000000000000000e01763000000000000000000eb271c0000000000000400bc01000000000000008df44791fc7f000007000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000068ae620000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f00000000000000000000105463000000000030ad62000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000e634630000000000fc34630000000000e6346300000000002a356300000000000000000000000000000000000000000000000000000000000000000000000000e634630000000000fc34630000000000e634630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000028c8630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f00000000000000000000b0f9640000000000f0c663000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c6a4630000000000dea4630000000000c6a46300000000000ca56300000000000000000000000000000000000000000000000000000000000000000000000000c6a4630000000000dea4630000000000c6a4630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000028c8630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f00000000000000000000505e630000000000f0c663000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000e630630000000000fa30630000000000e63063000000000028316300000000000000000000000000000000000000000000000000000000000000000000000000e630630000000000fa30630000000000e630630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a8cf630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f00000000000000000000d0f764000000000070ce63000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6c8630000000000eec8630000000000d6c86300000000001cc96300000000000000000000000000000000000000000000000000000000000000000000000000d6c8630000000000eec8630000000000d6c8630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a8cf630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f00000000000000000000505c63000000000070ce63000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000e63b630000000000fc3b630000000000e63b6300000000002a3c6300000000000000000000000000000000000000000000000000000000000000000000000000e63b630000000000fc3b630000000000e63b630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000a8cf630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f0000000000000000000090f664000000000070ce63000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000f6d66300000000000ed7630000000000f6d66300000000003cd76300000000000000000000000000000000000000000000000000000000000000000000000000f6d66300000000000ed7630000000000f6d6630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000088d7630000000000000000000000000000000000000000000100000096de000048b15f0000000000d8330cacfc7f0000000000000000000020f364000000000050d663000000000060e15aa8fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066d06300000000007ed063000000000066d0630000000000acd0630000000000000000000000000000000000000000000000000000000000000000000000000066d06300000000007ed063000000000066d0630000000000000000000000000000000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000d0000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000a85e95acfc7f000000000000000000009e3d73a7fc7f000000000000000000000000000000000000b0c5700000000000a0c57000000000000000000000000000343d73a7fc7f0000b0c5700000000000b0c5700000000000b0c570000000000000000000000000000000000000000000d0000000000000000000000000000000a85e95acfc7f0000cbd455f720b90000cc3919400100000000f85f0000000000a0c57000000000000000000000000000c800000000000000d000000000000000409d41abfc7f0000d0000000 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a10300000000000000000000008000000000000000000000000000000000000000000000000000007b8a55f720b9000000000000000000000000e8a5fc7f000001000000000000000000e8a5fc7f0000a8b75f0000000000b30590acfc7f00000000000000000000202b93acfc7f00000100000000000000559df5a5fc7f00000000000000000000b0ef8facfc7f00000000000000000000a8b75f0000000000010000000000000053a543abfc7f00000000e8a5fc7f000062260aaafc7f000001000000 (UID: 00000000-00002044)31:T52f,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp, 00000000-00002044.00000003.255773.9E39A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp, 00000000-00002044.00000003.255773.9E39A000.00000002.mdmp")32:T89f,Possible dll side loading: %LOCALAPPDATA%\WACUP\SETUP_X64\W7TBP.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_VGMSTREAM.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_VORBIS.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_MAGNUMOPUS.DLL %PROGRAMFILES%\WACUP\WINAMP.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_2SF.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_NOTYANSF.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_TTA.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_SC68K.DLL %PROGRAMFILES%\WACUP\PLUGINS\ML_HISTORY.DLL %PROGRAMFILES%\WACUP\WACUP_UPDATE.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_URL.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_CDDA.DLL %PROGRAMFILES%\WACUP\PLUGINS\GEN_TRANSCODE.DLL %PROGRAMFILES%\WACUP\LIBCURL.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_SIDIOUS.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_CAPTURE.DLL %LOCALAPPDATA%\WACUP\SETUP_X64\NSDIALOGS.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_PSF.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_LATER.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_MOD.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_USF2.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_GSF.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_TEXT.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_MSX.DLL %PROGRAMFILES%\WACUP\PLUGINS\ML_PLAYLISTS.DLL %LOCALAPPDATA%\WACUP\SETUP_X64\WACUP_HELPER.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_HIVELY.DLL %PROGRAMFILES%\WACUP\ZLIB.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_WAVE.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_SHNOBI.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_QSF.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_ADDANOTHERPLUG.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_ZIP.DLL %PROGRAMFILES%\WACUP\PLUGINS\ML_LL.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_DSD.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_ORG.DLL %LOCALAPPDATA%\WACUP\SETUP_X64\SYSTEM.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_SNSF.DLL %PROGRAMFILES%\WACUP\PLUGINS\GEN_REPLAYGAIN.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_AUDIO.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_PXTONE.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_MPC.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_FLAC.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_WV.DLL %PROGRAMFILES%\WACUP\WACUP_RES.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_NCSF.DLL ZLIB.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_VERMAS.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_APE.DLL %PROGRAMFILES%\WACUP\PLUGINS\IN_WEBMKV.DLL %PROGRAMFILES%\WACUP\PLUGINS\ML_BOOKMARKS.DLL33:T4fc,"wacup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "wacup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "wacup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "wacup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "wacup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "wacup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB")34:T40a,"WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\WACUP (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\WACUP\Setup_x64 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT (UID: 00000000-00002044)35:T2e48,"WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\WACUP\Setup_x64\System.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\WACUP\Setup_x64\wacup_helper.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\WACUP\Setup_x64\nsDialogs.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\WACUP\Setup_x64\w7tbp.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter wacup_update.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\wacup_update.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\winamp.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\libcurl.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\zlib.dll (UID: 00000000-00002044) "wacup.exe" called "LoadLibrary" with a parameter zlib.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\System\image.w5s (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\System\metadata.w5s (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_magnumopus.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_vorbis.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_mp4.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_ape.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_flac.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_wv.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_cdda.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_audio.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_capture.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_text.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_sidious.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_mpc.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_psf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_vermas.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_msx.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_addanotherplug.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_later.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_wave.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_mod.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_vgmstream.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_url.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_zip.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_usf2.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_2sf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_gsf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_ncsf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_snsf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_notyansf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_tta.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_dsd.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_sc68k.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_qsf.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_org.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_pxtone.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_hively.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_shnobi.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_webmkv.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\in_what.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\wacup_res.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_hotkeys.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_undo.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_ll.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_bookmarks.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_playlists.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_podcast.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_radio.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_history.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\ml_exporter.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_classicart.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_jumpex.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_timerestore.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_transcode.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_win7shell.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_wc.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_yule.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_play_remove.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_exclude.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_bigclock.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_repeater.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_waveseek.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_lyrics.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_win10shell.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_classic.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_replaygain.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\WACUP\Plugins\gen_bigclock2.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007508) "wacup.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007508)36:T361f,"WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Store (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter LoadImage (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #118 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Create (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetRTL (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CreateControl (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetUserData (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter OnClick (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #119 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Start (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter DllUnregisterServer (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #429 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter PathCchCombineEx (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #469 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter curl_global_sslset (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter curlx_base64_encode (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter curl_easy_unescape (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSAWaitForMultipleEvents (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSAResetEvent (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter WSACloseEvent (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #60 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #71 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter PropVariantToString (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #482 (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter inflateInit2_ (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter inflate (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00002044) "WACUP_Preview_v1_99_56_25346_x64.exe" called "GetProcAddress" with a parameter #163 (UID: 00000000-00002044) "wacup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter PathCchCombineEx (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter inflateInit2_ (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter inflate (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter GetWACUPComponent (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter winampGetInModule2 (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter crc32 (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter inflateValidate (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter GetDpiForSystem (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter winampGetGeneralPurposePlugin (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter SetDialogDpiChangeBehavior (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter RtlIsEcCode (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter winampGetMediaLibraryPlugin (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter PathCchRenameExtension (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter curl_global_sslset (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter curlx_base64_encode (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter curl_easy_unescape (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSAWaitForMultipleEvents (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSAResetEvent (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertOpenSystemStoreA (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertGetIntendedKeyUsage (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007508) "wacup.exe" called "GetProcAddress" with a parameter WSACloseEvent (UID: 00000000-00007508)37:T405,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002044.00000002.254156.9E22A000.00000002.mdmp")38:Ta89,Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2044:304:WilStaging_02" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2044:304:WilStaging_02" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2044:120:WilError_03" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2044:120:WilError_03" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "SM0:2044:304:WilStaging_02" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "Local\SM0:2044:304:WilStaging_02" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "Local\SM0:2044:120:WilError_03" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "SM0:2044:120:WilError_03" Process WACUP_Preview_v1_99_56_25346_x64.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process wacup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7508:304:WilStaging_02" Process wacup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7508:120:WilError_03" Process wacup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Winamp - C:\Program Files\WACUP\Plugins\gen_hotkeys.dll ^&*#@" Process wacup.exe created mutex with name "Local\SM0:7508:304:WilStaging_02" Process wacup.exe created mutex with name "Winamp - C:\Program Files\WACUP\Plugins\gen_hotkeys.dll ^&*#@" Process wacup.exe created mutex with name "SM0:7508:304:WilStaging_02" Process wacup.exe created mutex with name "SM0:7508:120:WilError_03" Process wacup.exe created mutex with name "Local\SM0:7508:120:WilError_03" Process wacup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03" Process wacup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7508:304:WilStaging_02" Process wacup.exe created mutex with name "\BaseNamedObjects\WACUP@C:/Program Files/WACUP/Winamp.dll-0x19956" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2744:304:WilStaging_02"39:Ta9f,Antivirus vendors marked dropped file "libcurl.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "in_vgmstream.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "wacup_helper.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "ucrtbase.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "in_mod.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "in_vermas.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "in_psf.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_2sf.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "msvcp140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_sc68k.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "tag2.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_addanotherplug.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "enc_fdkaac.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_org.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_gsf.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "ml_ll.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libsndfile.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "in_snsf.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "out_neo.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "in_usf2.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections")3a:T1001,"WACUP_Preview_v1_99_56_25346_x64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcurl.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_vgmstream.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "wacup_helper.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ucrtbase.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_mod.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_vermas.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_psf.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_2sf.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "msvcp140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_sc68k.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "tag2.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_addanotherplug.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "enc_fdkaac.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_org.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_gsf.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ml_ll.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libsndfile.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_snsf.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "out_neo.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_usf2.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "in_sidious.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF3b:T2662,"e\Software\C" in Source: 00000000-00002044.00000000.250315.00613000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002044.00000000.250315.4000B000.00000002.mdmp "e\Software\C" in Source: 00000000-00002044.00000001.252234.00613000.00000004.mdmp "e\Software\C" in Source: 00000000-00002044.00000002.254156.00613000.00000004.mdmp "SOFTWARE\Classes\%s\shell\%s%s" in Source: 00000000-00002044.00000002.254156.82E17000.00000002.mdmp "SOFTWARE\Clients\Media\%s%s%s" in Source: 00000000-00002044.00000002.254156.82E17000.00000002.mdmp "SOFTWARE\Classes\%s%s" in Source: 00000000-00002044.00000002.254156.82E17000.00000002.mdmp "SOFTWARE\Microsoft\Ole" in Source: 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp "Software\Microsoft\Input" in Source: 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp "e\Software\C" in Source: 00000000-00002044.00000003.255773.00613000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00002044.00000003.255773.006A3000.00000004.mdmp "h\Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00002044.00000003.255773.006A3000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00002044.00000003.255773.006A3000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\ShellEx\{2F711B17-773C-41D4-93FA-7F23EDCECB66}" in Source: 00000000-00002044.00000003.255773.006A3000.00000004.mdmp "\Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00002044.00000003.255773.006A3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00002044.00000003.255773.006CC000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{F0AE1542-F497-484B-A175-A20DB09144BA}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F0AE1542-F497-484B-A175-A20DB09144BA}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}23-0000-" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432No" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSIg" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}" in Source: 00000000-00002044.00000003.255773.07415000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00002044.00000003.255773.07444000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00002044.00000003.255773.07444000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00002044.00000003.255773.07444000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00002044.00000003.255773.07444000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{F0AE1542-F497-484B-A175-A20DB09144BA}" in Source: 00000000-00002044.00000003.255773.0747F000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002044.00000003.255773.0747F000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F0AE1542-F497-484B-A175-A20DB09144BA}" in Source: 00000000-00002044.00000003.255773.0747F000.00000004.mdmp "SOFTWARE\Classes\%s\shell\%s%s" in Source: 00000000-00002044.00000003.255773.928B7000.00000002.mdmp "SOFTWARE\Clients\Media\%s%s%s" in Source: 00000000-00002044.00000003.255773.928B7000.00000002.mdmp "SOFTWARE\Classes\%s%s" in Source: 00000000-00002044.00000003.255773.928B7000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007508.00000000.255859.32413000.00000004.mdmp "TRY\MACHINE\Software\Microsoft\WindowsRuntim" in Source: 00000000-00007508.00000000.255859.32448000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000000.255859.32470000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000000.255859.32470000.00000004.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007508.00000000.255859.82DBF000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007508.00000000.255859.82DBF000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00007508.00000000.255859.82DBF000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\DowngradeVersion" in Source: 00000000-00007508.00000000.255859.82DBF000.00000002.mdmp "SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007508.00000000.255859.82DBF000.00000002.mdmp "SOFTWARE\Classes\%s\shell\%s%s" in Source: 00000000-00007508.00000000.255859.928B7000.00000002.mdmp "SOFTWARE\Clients\Media\%s%s%s" in Source: 00000000-00007508.00000000.255859.928B7000.00000002.mdmp "SOFTWARE\Classes\%s%s" in Source: 00000000-00007508.00000000.255859.928B7000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000001.257779.32470000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000001.257779.32470000.00000004.mdmp "e\Software\C" in Source: 00000000-00007508.00000001.257779.324B4000.00000004.mdmp "Path=C:\ProgramDat\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000001.257779.34500000.00000004.mdmp "PUBLIC=C:\U\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00007508.00000001.257779.34500000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007508.00000001.257779.34500000.00000004.mdmp "SOFTWARE\Microsoft\Windows Media Foundation\Platform" in Source: 00000000-00007508.00000001.257779.37681000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007508.00000001.257779.376DB000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\LeapSecondInformation" in Source: 00000000-00007508.00000001.257779.94D35000.00000002.mdmp3c:T3ea7,"WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc925e0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffca7920000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 7ffca9de0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 7ffcac440000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "NTDLL.DLL" at base 7ffcac8f0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffca7390000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffca4b60000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ffca7d00000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 7ffca9820000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 7ffc91470000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 7ffcaa910000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ffca91a0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffca0e70000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 7ffc962c0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "KERNEL32.DLL" at base 7ffcabbd0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffc9df70000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%LOCALAPPDATA%\WACUP\SETUP_X64\SYSTEM.DLL" at base 7ffc95f40000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 7ffc8c060000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "COMCTL32.DLL" at base 7ffc94540000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%LOCALAPPDATA%\WACUP\SETUP_X64\WACUP_HELPER.DLL" at base 7ffc82cd0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "UXTHEME.DLL" at base 7ffca7920000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "RPCRT4.DLL" at base 7ffcab660000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%LOCALAPPDATA%\WACUP\SETUP_X64\NSDIALOGS.DLL" at base 7ffc95c40000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 3480000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "COMCTL32" at base 7ffc94540000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffcab780000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffcab780000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffcabdc0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffcab530000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffcaaaa0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 7ffc9e1d0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%LOCALAPPDATA%\WACUP\SETUP_X64\W7TBP.DLL" at base 7ffca3380000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffc8f230000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%PROGRAMFILES%\WACUP\WACUP_UPDATE.DLL" at base 7ffc92770000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%PROGRAMFILES%\WACUP\WINAMP.DLL" at base 7ffc85560000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%PROGRAMFILES%\WACUP\WINAMP.DLL" at base 7ffc92770000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%PROGRAMFILES%\WACUP\LIBCURL.DLL" at base 7ffc853e0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "SECUR32.DLL" at base 7ffc9e770000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "WS2_32.DLL" at base 7ffcaba40000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "ADVAPI32.DLL" at base 7ffcabca0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffca8f50000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffca9630000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffca0d30000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffca0730000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "SSPICLI.DLL" at base 7ffca9e10000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffca8e60000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffc97190000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc971e0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcaa800000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffca8010000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "CSCAPI.DLL" at base 7ffc9aea0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%PROGRAMFILES%\WACUP\ZLIB.DLL" at base 7ffc9e380000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffca7d30000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ffcaa9c0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "OLEAUT32" at base 7ffcaa9c0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffc95b90000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffca38b0000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 7ffca8b60000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffc9a500000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.FILEEXPLORER.COMMON.DLL" at base 7ffc86820000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "USER32.DLL" at base 7ffcab780000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffc9d290000 "WACUP_Preview_v1_99_56_25346_x64.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffcaa030000 "wacup.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc925e0000 "wacup.exe" loaded module "KERNEL32.DLL" at base 7ffcabbd0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffca7920000 "wacup.exe" loaded module "ZLIB.DLL" at base 7ffc9e380000 "wacup.exe" loaded module "RPCRT4.DLL" at base 7ffcab660000 "wacup.exe" loaded module "SSPICLI.DLL" at base 7ffca9e10000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffc9df70000 "wacup.exe" loaded module "SHELL32.DLL" at base 7ffcaaaa0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\SYSTEM\IMAGE.W5S" at base 7ffc9e1c0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\SYSTEM\METADATA.W5S" at base 7ffc90e40000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_MAGNUMOPUS.DLL" at base 7ffc90e10000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_VORBIS.DLL" at base 7ffc94520000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_MP4.DLL" at base 7ffc93490000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_APE.DLL" at base 7ffc90690000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_FLAC.DLL" at base 7ffc90630000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_WV.DLL" at base 7ffc94fe0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_CDDA.DLL" at base 7ffc8fc60000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_AUDIO.DLL" at base 7ffc94d20000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_CAPTURE.DLL" at base 7ffc8fc40000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_TEXT.DLL" at base 7ffc94b50000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_SIDIOUS.DLL" at base 7ffc8fb30000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_MPC.DLL" at base 7ffc8fc20000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_PSF.DLL" at base 7ffc8bf10000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_VERMAS.DLL" at base 7ffc875f0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_MSX.DLL" at base 7ffc86fb0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_ADDANOTHERPLUG.DLL" at base 7ffc86ab0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_LATER.DLL" at base 7ffc8faf0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_WAVE.DLL" at base 7ffc949d0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_MOD.DLL" at base 7ffc82ba0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_VGMSTREAM.DLL" at base 7ffc820f0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_URL.DLL" at base 7ffc8fac0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_ZIP.DLL" at base 7ffc947e0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_USF2.DLL" at base 7ffc8f6a0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_2SF.DLL" at base 7ffc85330000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_GSF.DLL" at base 7ffc8c1c0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_NCSF.DLL" at base 7ffc8f180000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_SNSF.DLL" at base 7ffc8bda0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_NOTYANSF.DLL" at base 7ffc872f0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_TTA.DLL" at base 7ffc8f860000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_DSD.DLL" at base 7ffca3380000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_SC68K.DLL" at base 7ffc82e60000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_QSF.DLL" at base 7ffc8bee0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_ORG.DLL" at base 7ffc86590000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_PXTONE.DLL" at base 7ffc8dd50000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_HIVELY.DLL" at base 7ffc82de0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_SHNOBI.DLL" at base 7ffc95f40000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_WEBMKV.DLL" at base 7ffc8cca0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\IN_WHAT.DLL" at base 7ffc8bec0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ffca23f0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\WACUP_RES.DLL" at base 25d343d0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_HOTKEYS.DLL" at base 7ffc87b10000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_UNDO.DLL" at base 7ffc95c40000 "wacup.exe" loaded module "COMCTL32.DLL" at base 7ffc94540000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_LL.DLL" at base 7ffc86f50000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_BOOKMARKS.DLL" at base 7ffc87850000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_PLAYLISTS.DLL" at base 7ffc875c0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_PODCAST.DLL" at base 7ffc82d90000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_RADIO.DLL" at base 7ffc95740000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_HISTORY.DLL" at base 7ffc95010000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\ML_EXPORTER.DLL" at base 7ffc962c0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_CLASSICART.DLL" at base 7ffc95000000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_JUMPEX.DLL" at base 7ffc8c0c0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_TIMERESTORE.DLL" at base 7ffc94ff0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_TRANSCODE.DLL" at base 7ffc8c0a0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_WIN7SHELL.DLL" at base 7ffc8c070000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_WC.DLL" at base 7ffc81fd0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_YULE.DLL" at base 7ffc82d60000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_PLAY_REMOVE.DLL" at base 7ffc86e60000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_EXCLUDE.DLL" at base 7ffc933d0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_BIGCLOCK.DLL" at base 7ffc92680000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_REPEATER.DLL" at base 7ffc91ee0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_WAVESEEK.DLL" at base 7ffc82d00000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_LYRICS.DLL" at base 7ffc91610000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_WIN10SHELL.DLL" at base 7ffc85310000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_CLASSIC.DLL" at base 7ffc915d0000 "wacup.exe" loaded module "%PROGRAMFILES%\WACUP\PLUGINS\GEN_REPLAYGAIN.DLL" at base 7ffc82ce0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.PLAYBACK.MEDIAPLAYER.DLL" at base 7ffc81ef0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.MEDIACONTROL.DLL" at base 7ffc81e60000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffca45f0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffca58c0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\MFMEDIAENGINE.DLL" at base 7ffc81a30000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.DEVICES.DLL" at base 7ffc81990000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.PLAYBACK.PROXYSTUB.DLL" at base 7ffc81970000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffca38b0000 "wacup.exe" loaded module "GDI32.DLL" at base 7ffcac330000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffc8f490000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffca8010000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\TASKFLOWDATAENGINE.DLL" at base 7ffc8d000000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffc95b90000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffca4b60000 "wacup.exe" loaded module "CSCAPI.DLL" at base 7ffc9aea0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcaa800000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffc8f230000 "wacup.exe" loaded module "SECUR32.DLL" at base 7ffc9e770000 "wacup.exe" loaded module "WS2_32.DLL" at base 7ffcaba40000 "wacup.exe" loaded module "ADVAPI32.DLL" at base 7ffcabca0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffca8f50000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffca9630000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffca0d30000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffca0730000 "wacup.exe" loaded module "CRYPT32.DLL" at base 7ffcaa5a0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 25d34a40000 "wacup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffcab780000 "wacup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffcab780000 "wacup.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffcabdc0000 "wacup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffcab5300003d:T801,"WACUP_Preview_v1_99_56_25346_x64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libcurl.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_vgmstream.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wacup_helper.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ucrtbase.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_mod.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_vermas.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_psf.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_2sf.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "msvcp140.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_sc68k.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "tag2.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_addanotherplug.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "enc_fdkaac.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_org.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_gsf.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ml_ll.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libsndfile.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_snsf.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "out_neo.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_usf2.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "in_sidious.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer"3e:T10e4,"WACUP_Preview_v1_99_56_25346_x64.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "HNetCfg.FwAuthorizedApplication" (Path: "HKCU\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "URL Zone Manager" (Path: "HKCU\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "PersistentZoneIdentifier" (Path: "HKCU\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "WACUP_Preview_v1_99_56_25346_x64.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "wacup.exe" touched "Window Property Store" (Path: "HKCU\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "wacup.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "wacup.exe" touched "MF Media Engine Class Factory" (Path: "HKCU\CLSID\{B44392DA-499B-446B-A4CB-005FEAD0E6D5}\TREATAS") "wacup.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "wacup.exe" touched "Application Document Lists" (Path: "HKCU\CLSID\{86BEC222-30F2-47E0-9F25-60D11CD75C28}\TREATAS") "wacup.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS")3f:T5e5,Process "wacup.exe" (UID: 00000000-00007508) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "wacup.exe" (UID: 00000000-00007508) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00002744) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008252) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2744_NXEWZDBNQEYCAGVO", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2744"" Process "msedge.exe" (UID: 00000000-00002656) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00003040) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"40:T5d8,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00002044-00000C2B-2585757024] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00002044-00000C2B-2585786532] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00002044-00000C2B-2586331042] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00002044-00000C2B-2586449317] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00002044-00000C2B-2586493087] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00002044-00000C2B-2586568777] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00002044-00000C2B-2586607297] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00002044-00000C2B-2586635739] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00002044-00000C2B-2586660695] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00002044-00000C2B-2586695874] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00002044-00000C2B-2586732376] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00002044-00000C2B-2586787460] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00002044-00000C2B-2587186338]41:T5c4,Spawned process "wacup.exe" with commandline "/SETUP" (UID: 00000000-00007508) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002744) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008252), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003052), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003040), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00001912), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00008120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003412), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002640), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00003756)42:T5c4,Spawned process "wacup.exe" with commandline "/SETUP" (UID: 00000000-00007508) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002744) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008252), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003052), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003040), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00001912), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00008120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003412), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002640), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00003756)43:Tbf8,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: E9:BF:27:01:93:50:91:D5:41:34:30:13:73:28:C0:A6:1D:B6:C2:07; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 54:63:5A:E5:FB:E2:61:FF:09:45:B7:52:A5:F0:02:2E:D9:63:F6:40; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: 20:68:99:D7:5C:1F:E1:8F:14:28:B6:96:30:2F:F8:D4:78:01:64:46; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 7E:9B:0B:64:0F:E9:7B:DD:92:F4:5A:F3:DF:89:50:51:E2:3F:3C:30; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information)44:T9a11,"libcurl.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\libcurl.dll]- [targetUID: 00000000-00007508] "in_vgmstream.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_vgmstream.dll]- [targetUID: 00000000-00007508] "wacup_helper.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\wacup_helper.dll]- [targetUID: 00000000-00002044] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\ucrtbase.dll]- [targetUID: 00000000-00002044] "in_mod.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_mod.dll]- [targetUID: 00000000-00007508] "in_vermas.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_vermas.dll]- [targetUID: 00000000-00007508] "in_psf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_psf.dll]- [targetUID: 00000000-00007508] "in_2sf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_2sf.dll]- [targetUID: 00000000-00007508] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\msvcp140.dll]- [targetUID: 00000000-00007508] "in_sc68k.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_sc68k.dll]- [targetUID: 00000000-00007508] "tag2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\tag2.dll]- [targetUID: 00000000-00002044] "in_addanotherplug.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_addanotherplug.dll]- [targetUID: 00000000-00007508] "enc_fdkaac.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_fdkaac.dll]- [targetUID: 00000000-00002044] "in_org.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_org.dll]- [targetUID: 00000000-00007508] "in_gsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_gsf.dll]- [targetUID: 00000000-00007508] "ml_ll.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\ml_ll.dll]- [targetUID: 00000000-00007508] "libsndfile.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\libsndfile.dll]- [targetUID: 00000000-00007508] "in_snsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_snsf.dll]- [targetUID: 00000000-00007508] "out_neo.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_neo.dll]- [targetUID: 00000000-00002044] "in_usf2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_usf2.dll]- [targetUID: 00000000-00007508] "in_sidious.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_sidious.dll]- [targetUID: 00000000-00007508] "libfaad2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\libfaad2.dll]- [targetUID: 00000000-00007508] "in_msx.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_msx.dll]- [targetUID: 00000000-00007508] "unrar.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\unrar.dll]- [targetUID: 00000000-00002044] "in_ncsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_ncsf.dll]- [targetUID: 00000000-00007508] "in_notyansf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_notyansf.dll]- [targetUID: 00000000-00007508] "wacup_res.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- Location: [%PROGRAMFILES%\WACUP\wacup_res.dll]- [targetUID: 00000000-00007508] "ml_playlists.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\ml_playlists.dll]- [targetUID: 00000000-00007508] "in_ape.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_ape.dll]- [targetUID: 00000000-00007508] "mpg123.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\mpg123.dll]- [targetUID: 00000000-00002044] "in_qsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_qsf.dll]- [targetUID: 00000000-00007508] "zlib.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\zlib.dll]- [targetUID: 00000000-00007508] "in_url.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_url.dll]- [targetUID: 00000000-00007508] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%PROGRAMFILES%\WACUP\vcruntime140.dll]- [targetUID: 00000000-00007508] "nde.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\nde.dll]- [targetUID: 00000000-00007508] "in_magnumopus.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_magnumopus.dll]- [targetUID: 00000000-00007508] "in_later.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_later.dll]- [targetUID: 00000000-00007508] "in_capture.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_capture.dll]- [targetUID: 00000000-00007508] "in_cdda.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_cdda.dll]- [targetUID: 00000000-00007508] "in_webmkv.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_webmkv.dll]- [targetUID: 00000000-00007508] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00002044] "ml_history.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\ml_history.dll]- [targetUID: 00000000-00007508] "ml_bookmarks.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\ml_bookmarks.dll]- [targetUID: 00000000-00007508] "in_mpc.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_mpc.dll]- [targetUID: 00000000-00007508] "wacup.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\wacup.exe]- [targetUID: 00000000-00007508] "in_tta.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_tta.dll]- [targetUID: 00000000-00007508] "out_notsoyasapi.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_notsoyasapi.dll]- [targetUID: 00000000-00002044] "in_pxtone.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_pxtone.dll]- [targetUID: 00000000-00007508] "in_vorbis.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_vorbis.dll]- [targetUID: 00000000-00007508] "msvcp140_atomic_wait.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\msvcp140_atomic_wait.dll]- [targetUID: 00000000-00007508] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\vcruntime140_1.dll]- [targetUID: 00000000-00007508] "gen_replaygain.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\gen_replaygain.dll]- [targetUID: 00000000-00007508] "in_flac.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_flac.dll]- [targetUID: 00000000-00007508] "gen_transcode.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\gen_transcode.dll]- [targetUID: 00000000-00007508] "lzma.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\lzma.dll]- [targetUID: 00000000-00002044] "in_hively.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_hively.dll]- [targetUID: 00000000-00007508] "out_notsodirect.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_notsodirect.dll]- [targetUID: 00000000-00002044] "in_zip.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_zip.dll]- [targetUID: 00000000-00007508] "out_notsoasio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_notsoasio.dll]- [targetUID: 00000000-00002044] "vcruntime140_threads.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\vcruntime140_threads.dll]- [targetUID: 00000000-00002044] "in_text.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_text.dll]- [targetUID: 00000000-00007508] "in_wave.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_wave.dll]- [targetUID: 00000000-00007508] "in_wv.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_wv.dll]- [targetUID: 00000000-00007508] "enc_tta.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_tta.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00002044] "System.dll" has type "PE32+ executable for MS Windows 5.01 (DLL) x86-64 (stripped to external PDB) 11 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\System.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00002044] "out_notsowavey.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_notsowavey.dll]- [targetUID: 00000000-00002044] "in_shnobi.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_shnobi.dll]- [targetUID: 00000000-00007508] "in_dsd.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_dsd.dll]- [targetUID: 00000000-00007508] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-console-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-console-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00002044] "enc_mp3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_mp3.dll]- [targetUID: 00000000-00002044] "enc_flac.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_flac.dll]- [targetUID: 00000000-00002044] "enc_opus.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_opus.dll]- [targetUID: 00000000-00002044] "discid.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\discid.dll]- [targetUID: 00000000-00002044] "in_audio.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_audio.dll]- [targetUID: 00000000-00007508] "enc_vorbis.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_vorbis.dll]- [targetUID: 00000000-00002044] "dsp_centercut.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\dsp_centercut.dll]- [targetUID: 00000000-00002044] "nsDialogs.dll" has type "PE32+ executable for MS Windows 5.01 (DLL) x86-64 (stripped to external PDB) 9 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\nsDialogs.dll]- [targetUID: 00000000-00002044] "enc_wav.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_wav.dll]- [targetUID: 00000000-00002044] "w7tbp.dll" has type "PE32+ executable for MS Windows 5.01 (DLL) x86-64 (stripped to external PDB) 8 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\w7tbp.dll]- [targetUID: 00000000-00002044] "image.w5s" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\System\image.w5s]- [targetUID: 00000000-00007508] "metadata.w5s" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\System\metadata.w5s]- [targetUID: 00000000-00007508] "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 151 x 24 resolution 2834 x 2834 px/m cbSize 74346 bits offset 54"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\modern-wizard.bmp]- [targetUID: 00000000-00002044] "version.rtf" has type "Rich Text Format data version 1 ANSI"- Location: [%PROGRAMFILES%\WACUP\version.rtf]- [targetUID: 00000000-00002044] "plugin_descriptions.ini" has type "Unknown"- Location: [%APPDATA%\WACUP\plugin_descriptions.ini]- [targetUID: 00000000-00002044] "license.rtf" has type "Rich Text Format data version 1 ANSI"- Location: [%PROGRAMFILES%\WACUP\license.rtf]- [targetUID: 00000000-00002044] "vgmstream64_ffmpeg_1.7z" has type "HTML document ASCII text with very long lines (4970)"- Location: [%PROGRAMFILES%\WACUP\Plugins\vgmstream_dlls\vgmstream64_ffmpeg_1.7z]- [targetUID: 00000000-00002044] "patreons.rtf" has type "Rich Text Format data version 1 ANSI code page 1252"- Location: [%APPDATA%\WACUP\patreons.rtf]- [targetUID: 00000000-00002044] "winamp.q1" has type "Unknown"- Location: [%APPDATA%\WACUP\winamp.q1]- [targetUID: 00000000-00002044] "Microsoft.VC143.CRT.manifest" has type "Unknown"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\Microsoft.VC143.CRT.manifest]- [targetUID: 00000000-00002044] "thanks.rtf" has type "Rich Text Format data version 1 ANSI"- Location: [%PROGRAMFILES%\WACUP\thanks.rtf]- [targetUID: 00000000-00002044] "gen_ml.ini" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\gen_ml.ini]- [targetUID: 00000000-00007508] "met662.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met662.vmd]- [targetUID: 00000000-00002044] "wacup.visualelementsmanifest.xml" has type "Unknown"- Location: [%PROGRAMFILES%\WACUP\wacup.visualelementsmanifest.xml]- [targetUID: 00000000-00002044] "met1634.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met1634.vmd]- [targetUID: 00000000-00002044] "met1644.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met1644.vmd]- [targetUID: 00000000-00002044] "met2606.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met2606.vmd]- [targetUID: 00000000-00002044] "met35E8.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met35E8.vmd]- [targetUID: 00000000-00002044] "met35D8.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met35D8.vmd]- [targetUID: 00000000-00002044] "met672.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met672.vmd]- [targetUID: 00000000-00002044] "met2616.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\met2616.vmd]- [targetUID: 00000000-00002044] "metB65F.vmd" has type "Unknown"- Location: [%APPDATA%\WACUP\Plugins\ml\views\metB65F.vmd]- [targetUID: 00000000-00002044] "paths.ini" has type "Unknown"- Location: [%PROGRAMFILES%\WACUP\paths.ini]- [targetUID: 00000000-00007508] "install.ini" has type "Unknown"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\install.ini]- [targetUID: 00000000-00002044] "profile.ini" has type "Unknown"- Location: [%APPDATA%\WACUP\profile.ini]- [targetUID: 00000000-00007508] "winamp.ini" has type "Unknown"- Location: [%APPDATA%\WACUP\winamp.ini]- [targetUID: 00000000-00007508] "wacup_update.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\WACUP\wacup_update.dll]- [targetUID: 00000000-00002044] "winamp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 9 sections"- Location: [%PROGRAMFILES%\WACUP\winamp.dll]- [targetUID: 00000000-00007508] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\ucrtbase.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-fibers-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-fibers-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-1.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-console-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-console-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-sysinfo-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-sysinfo-l1-2-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-kernel32-legacy-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-kernel32-legacy-l1-1-1.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%PROGRAMFILES%\WACUP\Microsoft.VC143.CRT\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00002044] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00002044] "modern-header.bmp" has type "PC bitmap Windows 3.x format 164 x 151 x 24 resolution 2834 x 2834 px/m cbSize 74346 bits offset 54"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\modern-header.bmp]- [targetUID: 00000000-00002044] "Microsoft.VC143.CRT.manifest" has type "Unknown"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\Microsoft.VC143.CRT.manifest]- [targetUID: 00000000-00002044]45:T652,"WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "")46:T10f7,"libcurl.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\libcurl.dll]- [targetUID: 00000000-00007508] "in_vgmstream.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_vgmstream.dll]- [targetUID: 00000000-00007508] "wacup_helper.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\wacup_helper.dll]- [targetUID: 00000000-00002044] "ucrtbase.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\WACUP\Setup_x64\Microsoft.VC143.CRT\ucrtbase.dll]- [targetUID: 00000000-00002044] "in_mod.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_mod.dll]- [targetUID: 00000000-00007508] "in_vermas.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_vermas.dll]- [targetUID: 00000000-00007508] "in_psf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_psf.dll]- [targetUID: 00000000-00007508] "in_2sf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_2sf.dll]- [targetUID: 00000000-00007508] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\msvcp140.dll]- [targetUID: 00000000-00007508] "in_sc68k.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_sc68k.dll]- [targetUID: 00000000-00007508] "tag2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\tag2.dll]- [targetUID: 00000000-00002044] "in_addanotherplug.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_addanotherplug.dll]- [targetUID: 00000000-00007508] "enc_fdkaac.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\enc_fdkaac.dll]- [targetUID: 00000000-00002044] "in_org.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_org.dll]- [targetUID: 00000000-00007508] "in_gsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_gsf.dll]- [targetUID: 00000000-00007508] "ml_ll.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\ml_ll.dll]- [targetUID: 00000000-00007508] "libsndfile.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\libsndfile.dll]- [targetUID: 00000000-00007508] "in_snsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_snsf.dll]- [targetUID: 00000000-00007508] "out_neo.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\out_neo.dll]- [targetUID: 00000000-00002044] "in_usf2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_usf2.dll]- [targetUID: 00000000-00007508] "in_sidious.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_sidious.dll]- [targetUID: 00000000-00007508] "libfaad2.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\libfaad2.dll]- [targetUID: 00000000-00007508] "in_msx.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_msx.dll]- [targetUID: 00000000-00007508] "unrar.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\unrar.dll]- [targetUID: 00000000-00002044] "in_ncsf.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WACUP\Plugins\in_ncsf.dll]- [targetUID: 00000000-00007508]47:Tdd0,"WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "WACUP_Preview_v1_99_56_25346_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "")48:T446,"WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\comctl32.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.6456_none_60b8a6cb71f64256\COMCTL32.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "\Device\KsecDD" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\Windows\System32\oleaut32.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to touch file "C:\FLTLIB.DLL"49:Tb75,"WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\install.ini" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\paths.ini" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\Microsoft.VC143.CRT.manifest" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-console-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-console-l1-2-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-datetime-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-debug-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-errorhandling-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-fibers-l1-1-1.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l1-2-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-file-l2-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-handle-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-heap-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-interlocked-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-kernel32-legacy-l1-1-1.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-libraryloader-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-localization-l1-2-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-memory-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-namedpipe-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Program Files\WACUP\Microsoft.VC143.CRT\api-ms-win-core-processenvironment-l1-1-0.dll"4a:T771,"WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WACUP (64-bit)\WACUP (64-bit).lnk" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WACUP (64-bit)\WACUP (64-bit) Safe Mode.lnk" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WACUP (64-bit)\WACUP (64-bit) Crash Collector.lnk" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WACUP (64-bit)\Uninstall WACUP (64-bit).lnk" "WACUP_Preview_v1_99_56_25346_x64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "wacup.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "wacup.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" "wacup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "wacup.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZI0SF75WVREUX6FZ7ISD.temp" "wacup.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "wacup.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations" "wacup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "wacup.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\ZI0SF75WVREUX6FZ7ISD.temp"4b:T4f7,"WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\MSVCP140.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\System.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\wacup_helper.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-console-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-console-l1-2-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-datetime-l1-1-0.dll" "WACUP_Preview_v1_99_56_25346_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WACUP\Setup_x64\Microsoft.VC143.CRT\api-ms-win-core-debug-l1-1-0.dll"4c:T87e,Found http requests in header "GET /files/vgmstream64_ffmpeg_1.7z" Found http requests in header "GET /files/milkdrop_presets_4.7z" Found http requests in header "GET /versions.json" Found http requests in header "GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US" Found http requests in header "GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US" Found http requests in header "GET /favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US" Found http requests in header "GET /favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US" Found http requests in header "GET /favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t"4d:T3086,Observed string: "{\rtf1\ansi{\fonttbl{\f0\fnil\fcharset0 Microsoft Sans Serif;}}\viewkind4\uc1\pard\sa200\sl276\slmult1\qc\b\f0\fs16\lang9 WACUP\b0\par\pard\sl276\slmult1 Copyright \'a9 2016-2026 Darren Owen aka DrO\parIndividual plug-ins included as part of WACUP by Darren Owen aka DrO & pre-existing WACUP are copyright respectively (starting from 2003).\par\pard\ri-1208\sl276\slmult1\tx8378\tx8520\par\pard\sl276\slmult1 Portions copyright their respective library & plug-in authors & contributors. This is detailed further down on a per license basis as applicable for them. All rights reserved.\par\parThere is no association or affiliation between WACUP & Winamp's current owners. Any skin(s) re-used &/or edited accordingly from those provided from the final AOL release of Winamp (v5.666) or the Winamp Skin Development SDK are provided as-is with all modifications freely available for those wanting them.\par\par\pard\sl276\slmult1\qc\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\par\pard\sl276\slmult1\par\pard\hyphpar0\widctlpar\sl276\slmult1\kerning1 This software is provided by the copyright holders & contributors "as is" & any express or implied warranties, including, but not limited to, the implied warranties of merchantability & fitness for a particular purpose are disclaimed. In no event shall the authors or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused & on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.\par\par\pard\hyphpar0\widctlpar\sl276\slmult1\qc\kerning0\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\kerning1\par\pard\hyphpar0\widctlpar\sl276\slmult1\parThe following libraries & plug-ins are used either in full or in part (subject to requirements, licensing & other applicable agreements) in addition to any original code to create the complete WACUP install.\par\par\pard\hyphpar0\widctlpar\sa200\sl276\slmult1\b Libraries:\par\pard\hyphpar0\widctlpar\sl276\slmult1\b0 avir - image processing library ({{\field{\*\fldinst{HYPERLINK https://github.com/avaneev/avir }}{\fldrslt{https://github.com/avaneev/avir\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2015-2026, Aleksey Vaneev\par\parFLAC - Free Lossless Audio Codec ({{\field{\*\fldinst{HYPERLINK https://xiph.org/flac/ }}{\fldrslt{https://xiph.org/flac/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2000-2009 Josh Coalson, 2011-2026 Xiph.Org Foundation\par\pargiflib ({{\field{\*\fldinst{HYPERLINK http://giflib.sourceforge.net/ }}{\fldrslt{http://giflib.sourceforge.net/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1997-2026 Eric S. Raymond & all other contributors.\par\parlame - LAME Ain't an MP3 Encoder ({{\field{\*\fldinst{HYPERLINK http://lame.sf.net }}{\fldrslt{http://lame.sf.net\ul0\cf0}}}}\f0\fs16 )\par\parlibatrac9 - Atrac9 decoder library for vgmstream ({{\field{\*\fldinst{HYPERLINK https://github.com/Thealexbarney/LibAtrac9 }}{\fldrslt{https://github.com/Thealexbarney/LibAtrac9\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2018-2026, Alex Barney\par\parlibcurl - The multiprotocol file transfer library ({{\field{\*\fldinst{HYPERLINK https://curl.haxx.se/libcurl/ }}{\fldrslt{https://curl.haxx.se/libcurl/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1996-2026, Daniel Stenberg & many contributors\par\parlibdeflate - Heavily optimized library for DEFLATE/zlib/gzip compression & decompression ({{\field{\*\fldinst{HYPERLINK https://github.com/ebiggers/libdeflate }}{\fldrslt{https://github.com/ebiggers/libdeflate\ul0\cf0}}}}\f0\fs16 )\par\parlibg719_decode - G.719 decoder library for vgmstream ({{\field{\*\fldinst{HYPERLINK https://github.com/kode54/libg719_decode }}{\fldrslt{https://github.com/kode54/libg719_decode\ul0\cf0}}}}\f0\fs16 )\par\parlibg7221_decode - G.7221 decoder library for vgmstream ({{\field{\*\fldinst{HYPERLINK https://github.com/kode54/libg7221_decode }}{\fldrslt{https://github.com/kode54/libg7221_decode\ul0\cf0}}}}\f0\fs16 )\par\parlibjpeg-turbo - JPEG library using SIMD instructions ({{\field{\*\fldinst{HYPERLINK http://libjpeg-turbo.org/ }}{\fldrslt{http://libjpeg-turbo.org/\ul0\cf0}}}}\f0\fs16 )\par\parlibogg ({{\field{\*\fldinst{HYPERLINK https://xiph.org/ogg/ }}{\fldrslt{https://xiph.org/ogg/\ul0\cf0}}}}\f0\fs16 ) & libvorbis ({{\field{\*\fldinst{HYPERLINK https://xiph.org/vorbis/ }}{\fldrslt{https://xiph.org/vorbis/\ul0\cf0}}}}\f0\fs16 ) libraries\parCopyright \'a9 2002-2026 Xiph.org Foundation\par\parlibopenmpt - OpenMPT based module player library ({{\field{\*\fldinst{HYPERLINK https://lib.openmpt.org/ }}{\fldrslt{https://lib.openmpt.org/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2004-2026, OpenMPT contributors\parCopyright \'a9 1997-2003, Olivier Lapicque\par\parlibpng - PNG Reference Library ({{\field{\*\fldinst{HYPERLINK http://libpng.sourceforge.net/ }}{\fldrslt{http://libpng.sourceforge.net/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2000-2002, 2004, 2006-2020 Glenn Randers-Pehrson\par\parlibebur128 - A library implementing the EBU R128 loudness standard ({{\field{\*\fldinst{HYPERLINK https://github.com/jiixyj/libebur128 }}{\fldrslt{https://github.com/jiixyj/libebur128\ul0\cf0}}}}\f0\fs16 )\par\parlibsndfile ({{\field{\*\fldinst{HYPERLINK http://www.mega-nerd.com/libsndfile/ }}{\fldrslt{http://www.mega-nerd.com/libsndfile/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1999-2026 Erik de Castro Lopo\par\parlibsoxr - SoX Resampler library ({{\field{\*\fldinst{HYPERLINK http://soxr.sourceforge.net/ }}{\fldrslt{http://soxr.sourceforge.net/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2007-2026 robs@users.sourceforge.net\par\parLZMA SDK ({{\field{\*\fldinst{HYPERLINK http://www.7-zip.org/sdk.html }}{\fldrslt{http://www.7-zip.org/sdk.html\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1999-2026 Igor Pavlov\par\parMaiAT3PlusDecoder - open source Atrac3+ compatible decoder library for vgmstream ({{\field{\*\fldinst{HYPERLINK https://sourceforge.net/projects/maiat3plusdec/ }}{\fldrslt{https://sourceforge.net/projects/maiat3plusdec/\ul0\cf0}}}}\f0\fs16 )\par\parnghttp2 - HTTP/2 C library ({{\field{\*\fldinst{HYPERLINK https://nghttp2.org/ }}{\fldrslt{https://nghttp2.org/\ul0\cf0}}}}\f0\fs16 )\par\parOpenSSL - General purpose cryptography library ({{\field{\*\fldinst{HYPERLINK https://www.openssl.org/ }}{\fldrslt{https://www.openssl.org/\ul0\cf0}}}}\f0\fs16 )\par\parpugixml - Light-weight, simple & fast XML parser ({{\field{\*\fldinst{HYPERLINK http://pugixml.org/ }}{\fldrslt{http://pugixml.org/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2006-2026 Arseny Kapoulkine\par\parrapidjson - A fast JSON parser / generator for C++ ({{\field{\*\fldinst{HYPERLINK http://rapidjson.org/ }}{\fldrslt{http://rapidjson.org/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2015 THL A29 Limited, a Tencent company, & Milo Yip.\par\parSpout2 - A video frame sharing system for Microsoft Windows ({{\field{\*\fldinst{HYPERLINK https://github.com/leadedge/Spout2 }}{\fldrslt{https://github.com/leadedge/Spout2\ul0\cf0}}}}\f0\fs16 )\par\partwitcurl - A C++ library for twitter APIs ({{\field{\*\fldinst{HYPERLINK https://github.com/swatkat/twitcurl }}{\fldrslt{https://github.com/swatkat/twitcurl\ul0\cf0}}}}\f0\fs16 )\par\parunrar ({{\field{\*\fldinst{HYPERLINK http://www.rarlab.com/rar_add.htm }}{\fldrslt{http://www.rarlab.com/rar_add.htm\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2002-2026 Alexander Roshal\par\parzlib-ng ({{\field{\*\fldinst{HYPERLINK https://github.com/Dead2/zlib-ng }}{\fldrslt{https://github.com/Dead2/zlib-ng\ul0\cf0}}}}\f0\fs16 ) & the\parzlib general purpose compression library ({{\field{\*\fldinst{HYPERLINK http://zlib.net/ }}{\fldrslt{http://zlib.net/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1995-2026 Jean-loup Gailly & Mark Adler\par& respective the zlib-ng authors under its license\par\par\par\pard\hyphpar0\widctlpar\sa200\sl276\slmult1\b Plug-ins:\b0\par\pard\hyphpar0\widctlpar\sl276\slmult1 Note: Copies of the source code for some of the WACUP modified plug-ins can be found at {{\field{\*\fldinst{HYPERLINK https://github.com/WACUP }}{\fldrslt{https://github.com/WACUP\ul0\cf0}}}}\f0\fs16 subject to the licensing requirements.\par\parASAP (Another Slight Atari Player) decoder ({{\field{\*\fldinst{HYPERLINK https://sourceforge.net/projects/asap/ }}{\fldrslt{https://sourceforge.net/projects/asap/\ul0\cf0}}}}\f0\fs16 )\parCopyleft \'a9 2005-2026 Piotr Fusik\par\parASIO Output Plug-in ({{\field{\*\fldinst{HYPERLINK http://otachan.com/out_asio(dll).html }}{\fldrslt{http://otachan.com/out_asio(dll).html\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2002-2006 Otachan\par\parBig Clock Plug-in ({{\field{\*\fldinst{HYPERLINK https://www.hartwork.org/ }}{\fldrslt{https://www.hartwork.org/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 saivert & Sebastian Pipping\par\parClassic Spectrum Analyzer (vis_classic.dll)\parCopyright \'a9 1998-2018 Mike Lynch\par\parCrystal Classic Skins Plug-in (gen_classic.dll)\parCopyright \'a9 Ioannis Epaminonda (aka TazDevil)\par\parLineIn Plug-in ({{\field{\*\fldinst{HYPERLINK http://home.hccnet.nl/th.v.d.gronde/dev/lineinWA2/ }}{\fldrslt{http://home.hccnet.nl/th.v.d.gronde/dev/lineinWA2/\ul0\cf0}}}}\f0\fs16 )\par(Note: This has been heavily modified to create the Audio Capture Plug-in)\parCopyright \'a9 1999-2014 Jasper van de Gronde\par\parsc68 (Atari ST & Amiga music player) ({{\field{\*\fldinst{HYPERLINK https://sourceforge.net/projects/sc68/ }}{\fldrslt{https://sourceforge.net/projects/sc68/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 1998-2016 Benjamin Gerard\par\parWinamp SIDPlayer Plug-in ({{\field{\*\fldinst{HYPERLINK https://github.com/zbych-r/in_sidplay2 }}{\fldrslt{https://github.com/zbych-r/in_sidplay2\ul0\cf0}}}}\f0\fs16 )\par(Note: This has been modified to create the SID Player Plug-in)\parCopyright \'a9 2017-2018 Zbigniew Ross\par\parWindows 7 Taskbar Integration Plug-in ({{\field{\*\fldinst{HYPERLINK https://github.com/TheSaw/win7shell/ }}{\fldrslt{https://github.com/TheSaw/win7shell/\ul0\cf0}}}}\f0\fs16 )\par(Note: This has been modified to create the Taskbar Integration Plug-in)\parCopyright \'a9 2009-2011 Magyari Attila\par\parvgmstream - Streamed audio decoder library for video game formats ({{\field{\*\fldinst{HYPERLINK https://hcs64.com/vgmstream.html }}{\fldrslt{https://hcs64.com/vgmstream.html\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2008-2026 hcs, FastElbja, manakoAT, bxaimc, snakemeat, kode54 & all other contributors.\par\parWinampMatrixMixer Plug-in ({{\field{\*\fldinst{HYPERLINK https://sourceforge.net/projects/winampmatrixmix/ }}{\fldrslt{https://sourceforge.net/projects/winampmatrixmix/\ul0\cf0}}}}\f0\fs16 )\par\parWaveform Seeker Plug-in ({{\field{\*\fldinst{HYPERLINK https://github.com/gargaj/gen-waveseek }}{\fldrslt{https://github.com/gargaj/gen-waveseek\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 Gargaj\par\par\par\pard\hyphpar0\widctlpar\sa200\sl276\slmult1\b 3rd Party Tools: & Other Resources\b0\par\pard\hyphpar0\widctlpar\sl276\slmult1 Winamp Backup Tool ({{\field{\*\fldinst{HYPERLINK http://koopa.meggamusic.co.uk/backuptool/ }}{\fldrslt{http://koopa.meggamusic.co.uk/backuptool/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2010-2026 by Christoph Grether\par\parWinamp Info Tool ({{\field{\*\fldinst{HYPERLINK http://koopa.meggamusic.co.uk/infotool/ }}{\fldrslt{http://koopa.meggamusic.co.uk/infotool/\ul0\cf0}}}}\f0\fs16 )\parCopyright \'a9 2011-2026 by Christoph Grether\par\paryt-dlp ({{\field{\*\fldinst{HYPERLINK https://github.com/yt-dlp/yt-dlp }}{\fldrslt{https://github.com/yt-dlp/yt-dlp\ul0\cf0}}}}\f0\fs16 )\par\pard\sl276\slmult1\kerning0\par\pard\sl276\slmult1\qc\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\emdash\par\pard\sl276\slmult1\par\pard\sa200\sl276\slmult1 Last Updated: 25 Aug 2026\par" (Indicator: "curl -") in Source: license.rtf4e:T52bd,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002044.00000000.250315.4000B000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002044.00000000.250315.4002D000.00000004.mdmp") Found URL "https://getwacup.com/" - Source: "00000000-00002044.00000001.252234.4018A000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002044.00000002.254156.4002D000.00000004.mdmp") Found URL "https://skins.webamp.org/randskinneurotechskinsskindirfilter%s\%s\%s%s\%s.zipbento" - Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp") Found URL "https://getwacup.com/2026%satf_help.htmlerror" - Source: "00000000-00002044.00000002.254156.82E17000.00000002.mdmp") Found URL "http://%shi.%shi.%shdmikeepalive/safe=1streammetadata%d%cintro_play/skin.xmlintro_fadeintro_timefadeout_timeintro_fade_timevisplugin_autorunvis_*.dllvisplugin_autoexec%s/title/title.html/currentsong/nextsong%s^4]@pa2]*]4]@pa2]*]4]$[4]@pa2]*]4])[4]@pa2]" - Source: "00000000-00007508.00000001.257779.34585000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crlprovider=default,fips=yes,input=der,structure=subjectpublickeyinfoprovider=default,fips=yes,input=der,structure=type-specificbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt" - Source: "00000000-00007508.00000001.257779.37600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00007508.00000001.257779.37600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0b0@4http://www.microsoft.com/pkiops/docs/repository.htmtw1" - Source: "00000000-00007508.00000001.257779.37600000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crlglobalsign" - Source: "00000000-00007508.00000001.257779.37600000.00000004.mdmp") Found URL "http://yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crltp://yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crlhttps:getwacup.com:443:key-v3:tlsver-6-0:tlsopt-50:native-ca:impl-13:openssl/3.5.9:g_uuuu@pa2]*]4]@pa2]*]4]@pa2]*]4]^a7]@pa2]ya7]@pa2]*]4]@pa2]*]4]@pa2]*]4]@pa2][a7]@pa2]*]4]@pa2]*]4]" - Source: "00000000-00007508.00000001.257779.37600000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.\" (Indicator: \"AESNI\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")\n Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\WACUP\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002044-00000C2E-168570086189\")\n Found string \"C:\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002044.00000000.250315.00613000.00000004.mdmp, 00000000-00002044.00000001.252234.00613000.00000004.mdmp, 00000000-00002044.00000002.254156.00613000.00000004.mdmp, 00000000-00002044.00000003.255773.00613000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9975","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002044-00000C2C-2588272508\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"EnumSystemFirmwareTables\"; File: \"api-ms-win-core-sysinfo-l1-2-0.dll\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002044-00000C2C-2588272508\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002044.00000002.254156.9E22A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"unrar.dll\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002044-00000C2C-2659331690\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002044)\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"wacup.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"wacup.exe\" called \"IsWow64Process\" with parameter \"7508\" - (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"wacup.exe\" called \"EnumWindows\" with parameter \"2\" - (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2f","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"wacup.exe\" called \"GetActiveWindow\" (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000654a00000200000000000000010000000000000008f45f00000000008cc291acfc7f000002000000000000000000000000000000dbd755f720b90000000036a65cb1000000000000000000009cc05690fc7f00007805000000000000b0a2610000000000010000000000000000010000040000000800000000000000ea600d8cfc7f000000000000 (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wacup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" queried token user identity (UID: 00000000-00002044)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002044-00000C17-2661702995\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002044-00000C17-2661834010\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002044-00000C17-2661849807\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002044-00000C17-2661866478\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002044-00000C17-2661897795\n \"wacup.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007508-00000C17-2677224854\n \"wacup.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007508-00000C17-2677240648","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wacup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wacup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WACUP (X64)\"), \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WACUP\"), \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WACUP_PREVIEW_V1_99_56_25346_X64.EXE\"), \"wacup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WACUP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"wacup.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"wacup.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\"\n \"wacup.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eace5dd7a7e4617.automaticDestinations-ms\"\n \"wacup.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\eace5dd7a7e4617.customDestinations-ms\"\n \"wacup.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZI0SF75WVREUX6FZ7ISD.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002044.00000000.250315.4002D000.00000004.mdmp, 00000000-00002044.00000002.254156.4002D000.00000004.mdmp, 00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.95C49000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$34","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"MoveFileW\" with parameter %PROGRAMFILES%\\WACUP\\wacup_update.dll & %PROGRAMFILES%\\WACUP\\winamp.dll (UID: 00000000-00002044)\n \"wacup.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZI0SF75WVREUX6FZ7ISD.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\eace5dd7a7e4617.customDestinations-ms (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"getwacup.com\"\n \"ecn.dev.virtualearth.net\"\n \"services.bingapis.com\"\n \"t.ssl.ak.dynamic.tiles.virtualearth.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"77.72.1.28:443\"\n \"23.61.246.220:443\"\n \"23.46.228.101:443\"\n \"3.171.117.62:443\"\n \"150.171.74.13:443\"\n \"23.56.109.209:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select a visualisation plug-in below. The plug-in can be launched using the 'Start' button or by using Ctrl+Shift+K from WACUP.\" (Source: 00000000-00002044.00000002.254156.82E4C000.00000002.mdmp, 00000000-00002044.00000003.255773.928EC000.00000002.mdmp, Indicator: \"select a visualisation plug-in below. the plug-in can be launched using the 'start' button or by using ctrl+shift+k from wacup.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$38","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$39","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" failed to load missing module \"wacup_update.dll\" - [base:0; Status:c0000135]\n \"wacup.exe\" failed to load missing module \"%PROGRAMFILES%\\WACUP\\Plugins\\gen_bigclock2.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3a","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"bug@getwacup.com\"\n Pattern match: \"robs@users.sourceforge.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"YouTube\" (Indicator: \"youtube\"; File: \"screen_12.png\")\n Found string \"%APPDATA%\\WACUP\\WACUP_Tools\\youtube-dl.exe\" (Indicator: \"youtube\"; Source: \"00000000-00002044-00000C2E-168523892020\")\n Found string \"%APPDATA%\\WACUP\\WACUP_Tools\\youtube-dl*.exe\" (Indicator: \"youtube\"; Source: \"00000000-00002044-00000C2E-168527532664\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00002744)\n Launches browser \"msedge.exe\" (UID: 00000000-00008252)\n Launches browser \"msedge.exe\" (UID: 00000000-00002656)\n Launches browser \"msedge.exe\" (UID: 00000000-00003052)\n Launches browser \"msedge.exe\" (UID: 00000000-00003040)\n Launches browser \"msedge.exe\" (UID: 00000000-00001912)\n Launches browser \"msedge.exe\" (UID: 00000000-00008120)\n Launches browser \"msedge.exe\" (UID: 00000000-00003412)\n Launches browser \"msedge.exe\" (UID: 00000000-00002640)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 8C060000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A9F80000\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AA800000\n \"wacup.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A9F80000\n \"wacup.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AA800000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AB660000\n \"wacup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AB660000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a321aafc7f0000@ntdll.dll\"\n \"220023000000000038a321aafc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3d","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ecn.dev.virtualearth.net\"\n \"getwacup.com\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"t.ssl.ak.dynamic.tiles.virtualearth.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"wacup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"wacup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" searching for class \"#32770\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" searching for class \"Shell_TrayWnd\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" searching for class \"msctls_progress32\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" searching for class \"WACUPAgent\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" searching for class \"WinampAgentMain\"\n \"wacup.exe\" searching for class \"Shell_TrayWnd\"\n \"wacup.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$43","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssA21E.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"wacup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"wacup.visualelementsmanifest.xml\" has type \"Unknown\" - Location: [%PROGRAMFILES%\\WACUP\\wacup.visualelementsmanifest.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$46","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" queries basic process information of the \"C:\\WACUP_Preview_v1_99_56_25346_x64.exe\" (UID: 2044)\n \"wacup.exe\" queries basic process information of the \"C:\\Program Files\\WACUP\\wacup.exe\" (UID: 7508)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" reads file \"c:\\wacup_preview_v1_99_56_25346_x64.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WACUP (64-bit)\\WACUP (64-bit).lnk\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WACUP (64-bit)\\WACUP (64-bit) Safe Mode.lnk\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WACUP (64-bit)\\WACUP (64-bit) Crash Collector.lnk\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\WACUP (64-bit)\\Uninstall WACUP (64-bit).lnk\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\WACUP (64-bit).lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Program Files\\WACUP\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\WACUP\\Setup_x64\\modern-header.bmp\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\WACUP\\Setup_x64\\modern-wizard.bmp\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\Microsoft.VC143.CRT.manifest\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\Desktop\\WACUP\"\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" trying to access non-existent file \"C:\\Windows\\System32\\UXTHEME.dll.Config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nssa21e.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"api-ms-win-core-memory-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"This is entered into the chosen source to connect to the server.\" (Indicator: \" connect \"; Source: \"00000000-00002044.00000002.254156.82E4C000.00000002.mdmp, 00000000-00002044.00000003.255773.928EC000.00000002.mdmp\")\n Found reference to API \"calling wsastartup()\" (Indicator: \"wsastartup\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"192.168.0.2\"\n \"1.3.101.113\"\n \"1.3.101.112\"\n \"1.3.101.110\"\n \"1.3.101.111\"\n \"0.1.3.2\"\n Potential IP \"1.3.101.110\" found in string \"X25519:1.3.101.110\"\n Potential IP \"1.3.101.111\" found in string \"X448:1.3.101.111\"\n Potential IP \"1.3.101.112\" found in string \"ED25519:1.3.101.112\"\n Potential IP \"1.3.101.113\" found in string \"ED448:1.3.101.113\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"ecn.dev.virtualearth.net\" has high entropy\n Contacted domain: \"services.bingapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"r.msftstatic.com\" (5 days old)\n Newly renewed or created SSL certificate: \"sb.scorecardresearch.com\" (3 days old)\n Newly renewed or created SSL certificate: \"services.bingapis.com\" (9 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$51","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"getwacup.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"77.72.1.28\" on port \"443\"\n HTTPS traffic to \"23.61.246.220\" on port \"443\"\n HTTPS traffic to \"23.46.228.101\" on port \"443\"\n HTTPS traffic to \"3.171.117.62\" on port \"443\"\n HTTPS traffic to \"150.171.74.13\" on port \"443\"\n HTTPS traffic to \"23.56.109.209\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007508\"\n YARA signature for AES encryption matched on file \"lzma.dll\"\n YARA signature for AES encryption matched on process \"00000000-00002044\"\n YARA signature for AES encryption matched on file \"unrar.dll\"\n YARA signature for AES encryption matched on file \"libcurl.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"libcurl.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"-+ncalrpc:[OLECD27034EB9F854A278B420153D0C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000003.255773.006CC000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLEBF670292F3331ECDCC201855EE9E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.07415000.00000004.mdmp, 00000000-00002044.00000003.255773.07444000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE1C85F3BA2B9D0AFC5C7CD7A5715D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000003.255773.006CC000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00002044.00000003.255773.006CC000.00000004.mdmp, 00000000-00002044.00000003.255773.07444000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000003.255773.07444000.00000004.mdmp\")\n Found string \"=9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002044.00000003.255773.0747F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"C:\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000003.255773.006CC000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000003.255773.07415000.00000004.mdmp, 00000000-00002044.00000003.255773.07444000.00000004.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000003.255773.07444000.00000004.mdmp\")\n Found string \"{Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002044.00000003.255773.07444000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"api-ms-win-core-file-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"8211090849320,5052,3024,,RtlGetVersion,NTDLL.dll,\"01:06:34.406\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002044.00000003.255773.07400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.8563E000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002044.00000002.254156.9E22A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wacup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"wacup.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetComputerNameW\" (UID: 00000000-00002044)\n \"wacup.exe\" called \"GetComputerNameW\" (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"wacup.exe\" called \"GetUserNameW\" (UID: 00000000-00007508)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000002.254156.9E22A000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$55","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname mismatch\" (Indicator: \"hostname\"; Source: \"00000000-00002044.00000003.255773.8563E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"wacup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" opened \"\\Device\\KsecDD\"\n \"wacup.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002044.00000002.254156.9E22A000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002044.00000002.254156.9E22A000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002044.00000002.254156.9E22A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5b","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"modern-wizard.bmp\" has type \"PC bitmap Windows 3.x format 164 x 151 x 24 resolution 2834 x 2834 px/m cbSize 74346 bits offset 54\" and extension \"bmp\"\n \"modern-header.bmp\" has type \"PC bitmap Windows 3.x format 164 x 151 x 24 resolution 2834 x 2834 px/m cbSize 74346 bits offset 54\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Junk code insertion patterns detected","description":"Excessive NOP sled detected (128 consecutive NOPs) at offset 289119","origin":"Binary File","mitre_attack_id":"T1027.016","relevance":7,"id":"binary-9001","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" at 00000000-00002044-00000C15-2672418387","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"sf2.dll\"; File: \"in_usf2.dll\")\n file/memory contains long string with (Indicator: \"sf2.dll\"; File: \"plugin_descriptions.ini\")\n Found string \"in_usf2.dll\" (Indicator: \"sf2.dll\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")\n Found string \"https://download.sysinternals.com/files/Procdump.zip\" (Indicator: \"sysinternals\"; Source: \"00000000-00002044.00000002.254156.82E17000.00000002.mdmp, 00000000-00002044.00000003.255773.928B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"getwacup.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"9a5fe30\"\n \"ppResult\": \"00bb450700000000\"}\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"getwacup.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"926fe30\"\n \"ppResult\": \"0000000000000000\"}\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"getwacup.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"9c5fe30\"\n \"ppResult\": \"908e6e0000000000\"}\n \"wacup.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"getwacup.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"d6b87ffc30\"\n \"ppResult\": \"f00b5f345d020000\"}\n \"wacup.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"getwacup.com\"\n \"pServiceName\": \"443\"\n \"pHints\": \"d6b86ff990\"\n \"ppResult\": \"0000000000000000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\WACUP_Preview_v1_99_56_25346_x64.exe\" queried ProcessMitigationPolicy\n \"C:\\Program Files\\WACUP\\wacup.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 23.46.228.101\"\n \"UDP connection to 23.56.109.209\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5f","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$60","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 77.72.1.28 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$61","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\"; Key: \"ALWAYSSHOWEXT\")\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\"; Key: \"NEVERSHOWEXT\")\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WACUP_Preview_v1_99_56_25346_x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"image.w5s\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%PROGRAMFILES%\\WACUP\\System\\image.w5s]- [targetUID: 00000000-00007508]\n \"metadata.w5s\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%PROGRAMFILES%\\WACUP\\System\\metadata.w5s]- [targetUID: 00000000-00007508]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"image.w5s\" has unusual extension\n \"metadata.w5s\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"intel_graph":{"map":{"Domain:64bb032e7a8ff3f00311bf4fd34d94b1bc8a22ee00f080f2e5c1d17c27e851e9":{"type":"Domain","value":"sourceforge.net","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:ecn.dev.virtualearth.net":{"type":"Domain","value":"ecn.dev.virtualearth.net"},"Domain:getwacup.com":{"type":"Domain","value":"getwacup.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:t.ssl.ak.dynamic.tiles.virtualearth.net":{"type":"Domain","value":"t.ssl.ak.dynamic.tiles.virtualearth.net"},"File:00cbabc8e73828b65f10d452e1856e5eb03147c89c16812e815c5e7d5b968de9":{"type":"File","value":"00cbabc8e73828b65f10d452e1856e5eb03147c89c16812e815c5e7d5b968de9"},"File:0156d660fd266775673b930c7decebb9874e102345d226ca85ec64f15bc3d881":{"type":"File","value":"0156d660fd266775673b930c7decebb9874e102345d226ca85ec64f15bc3d881"},"File:03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b":{"type":"File","value":"03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:085ba6705e6420e44518d437aa45b8304319bd9f433e601f7e373a62a98d4d24":{"type":"File","value":"085ba6705e6420e44518d437aa45b8304319bd9f433e601f7e373a62a98d4d24","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:091ed228d2928e22e5e4cc8674207692544093f2ff81f0435f3b94669b44dce7":{"type":"File","value":"091ed228d2928e22e5e4cc8674207692544093f2ff81f0435f3b94669b44dce7"},"File:09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781":{"type":"File","value":"09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:0bc5624723725ed188ac781b9b9e8faef90921bfb3cb7efb2dce6bf9aead00b5":{"type":"File","value":"0bc5624723725ed188ac781b9b9e8faef90921bfb3cb7efb2dce6bf9aead00b5"},"File:0e822bd2062f234a2272846e0a52f7e30d60631ca8aed010a21a636319cefc6e":{"type":"File","value":"0e822bd2062f234a2272846e0a52f7e30d60631ca8aed010a21a636319cefc6e"},"File:0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43":{"type":"File","value":"0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6":{"type":"File","value":"0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9":{"type":"File","value":"0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:142939fdd15ffdb658cb27926c1ab99b573df22330eecd81b31b531a808a0ad4":{"type":"File","value":"142939fdd15ffdb658cb27926c1ab99b573df22330eecd81b31b531a808a0ad4"},"File:14841d2123bf26df2d2d61b60f503840efe5936928670ffef1816eb30928367c":{"type":"File","value":"14841d2123bf26df2d2d61b60f503840efe5936928670ffef1816eb30928367c"},"File:14c37023ea67ec68d121d13866e1af5657af3a58665a9308f6b372652b349344":{"type":"File","value":"14c37023ea67ec68d121d13866e1af5657af3a58665a9308f6b372652b349344"},"File:1721e50bfd45f4fb4134b07f344b859d4a89626b88552c15a45b6514810aef21":{"type":"File","value":"1721e50bfd45f4fb4134b07f344b859d4a89626b88552c15a45b6514810aef21"},"File:17d6ef28c1f6ac2fead5f2ff2a2e5ac204a4854a429a543032a6407a0d9ed2ef":{"type":"File","value":"17d6ef28c1f6ac2fead5f2ff2a2e5ac204a4854a429a543032a6407a0d9ed2ef","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827":{"type":"File","value":"18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:1aefa74e576383ac2ba641a467731116d57f822e17820565f96c4479d516d5ad":{"type":"File","value":"1aefa74e576383ac2ba641a467731116d57f822e17820565f96c4479d516d5ad"},"File:1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be":{"type":"File","value":"1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:1c9247245e63dd20b406de29520f77c98967a0a3a96c940ea2ebdd6eee9280bc":{"type":"File","value":"1c9247245e63dd20b406de29520f77c98967a0a3a96c940ea2ebdd6eee9280bc"},"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f":{"type":"File","value":"1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51":{"type":"File","value":"2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa":{"type":"File","value":"219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:246bd5531ff2507702456438d4654c269618d9d5225641c241df47121017f8dc":{"type":"File","value":"246bd5531ff2507702456438d4654c269618d9d5225641c241df47121017f8dc"},"File:24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6":{"type":"File","value":"24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:25046cd6057ba1ef9ef01b69f9e919ea1159fde9e951ccad13a8d27ca19d32ec":{"type":"File","value":"25046cd6057ba1ef9ef01b69f9e919ea1159fde9e951ccad13a8d27ca19d32ec","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:26b2087aaa7630a5faa4a60460f7310829990aa97bc090c13f05cdc180e71a32":{"type":"File","value":"26b2087aaa7630a5faa4a60460f7310829990aa97bc090c13f05cdc180e71a32"},"File:276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2":{"type":"File","value":"276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:28e673356267d156b1524169b6d954690b9e63ca3824fa28edcc3609214ed9dc":{"type":"File","value":"28e673356267d156b1524169b6d954690b9e63ca3824fa28edcc3609214ed9dc","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:290ea771ea62282e55b40e67bd6779d7a15aa9d9a7ead0a07acb6bf2b30cb928":{"type":"File","value":"290ea771ea62282e55b40e67bd6779d7a15aa9d9a7ead0a07acb6bf2b30cb928","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:2a0e91c2370abf93781dabbbfdb1d7bd459f4c212710006172ab8581db8b3dec":{"type":"File","value":"2a0e91c2370abf93781dabbbfdb1d7bd459f4c212710006172ab8581db8b3dec"},"File:2a1e8ba097b8e41394a4434e9df579b15716e6b717ca487f1c9fc7d328da4d9e":{"type":"File","value":"2a1e8ba097b8e41394a4434e9df579b15716e6b717ca487f1c9fc7d328da4d9e","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:2a303ab60c40124efc793b7facdccf581524d271f8c48f7cff84794ae70a09e3":{"type":"File","value":"2a303ab60c40124efc793b7facdccf581524d271f8c48f7cff84794ae70a09e3"},"File:2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48":{"type":"File","value":"2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:30fd4f5574658d34eeaacb5201ece6c9810ce1fa4fc76b6cbee7f0c83cb390e8":{"type":"File","value":"30fd4f5574658d34eeaacb5201ece6c9810ce1fa4fc76b6cbee7f0c83cb390e8"},"File:3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d":{"type":"File","value":"3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:32af8ca41c4cfce9a7ffac402ebdced89d3328d0072bcc371301663e478b7c9b":{"type":"File","value":"32af8ca41c4cfce9a7ffac402ebdced89d3328d0072bcc371301663e478b7c9b"},"File:33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a":{"type":"File","value":"33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b":{"type":"File","value":"33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:33b740d0ed92d0d68ae7bfbda0963d16acb6df5c7f7ebf5d4749a453bcab2a55":{"type":"File","value":"33b740d0ed92d0d68ae7bfbda0963d16acb6df5c7f7ebf5d4749a453bcab2a55","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:349017bdf3c8a522cc9a9085b48639c8b37a17e829b3199e8b766455b8ff2879":{"type":"File","value":"349017bdf3c8a522cc9a9085b48639c8b37a17e829b3199e8b766455b8ff2879"},"File:35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8":{"type":"File","value":"35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52":{"type":"File","value":"3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3":{"type":"File","value":"37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:39a3771040889cd5687886a47673e463fc1c11f0912db3037be6a723eea24e05":{"type":"File","value":"39a3771040889cd5687886a47673e463fc1c11f0912db3037be6a723eea24e05"},"File:3af24743b2706303a9f32cc31c4991d88280757eaa61060bfdf7bea751cc6273":{"type":"File","value":"3af24743b2706303a9f32cc31c4991d88280757eaa61060bfdf7bea751cc6273"},"File:44c2043b90af0b5c57189a474102530a31b098e40ab2ca5fafa56ac57e5575df":{"type":"File","value":"44c2043b90af0b5c57189a474102530a31b098e40ab2ca5fafa56ac57e5575df","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:46500d39474293eb3b830eae2cf42bf2a049544e84dfe1458ce155153adf7b89":{"type":"File","value":"46500d39474293eb3b830eae2cf42bf2a049544e84dfe1458ce155153adf7b89"},"File:481929a6a64704835eb84e8929941ae6f22545c682d21e41a3adb6a14c577074":{"type":"File","value":"481929a6a64704835eb84e8929941ae6f22545c682d21e41a3adb6a14c577074"},"File:4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5":{"type":"File","value":"4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:488cbafbee826ad9d32d86508b53b067504cae31ec1ebf271c402ccd34a9b9fb":{"type":"File","value":"488cbafbee826ad9d32d86508b53b067504cae31ec1ebf271c402ccd34a9b9fb"},"File:4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa":{"type":"File","value":"4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:4b1e45c1ee0350bb30bad5f5df6dabab10201c7ac1252cd1e0f62861158eea93":{"type":"File","value":"4b1e45c1ee0350bb30bad5f5df6dabab10201c7ac1252cd1e0f62861158eea93"},"File:4b6bec03b6150595cc5fc695e0f2f7fac03c5f0f6c2f0b92f8c1a9d1b85961ce":{"type":"File","value":"4b6bec03b6150595cc5fc695e0f2f7fac03c5f0f6c2f0b92f8c1a9d1b85961ce","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 2 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd":{"type":"File","value":"4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534":{"type":"File","value":"4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:506f80f779dd95419a8fbda3cabd770614046b64b1be0455b62558664db85f4f":{"type":"File","value":"506f80f779dd95419a8fbda3cabd770614046b64b1be0455b62558664db85f4f"},"File:509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896":{"type":"File","value":"509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:51be2a6cb12211f359fa8b4c375a423cf72378b2bbf6737e29352bdfa6bb234d":{"type":"File","value":"51be2a6cb12211f359fa8b4c375a423cf72378b2bbf6737e29352bdfa6bb234d","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:52ac9cf92558bca053ae8ec95c87ec2e7b39d3ca8e013676060a2f3b6adb4930":{"type":"File","value":"52ac9cf92558bca053ae8ec95c87ec2e7b39d3ca8e013676060a2f3b6adb4930"},"File:544e919612b6856256763ef38b64661c0aa7f2dd95e3316c2651f7953d507b00":{"type":"File","value":"544e919612b6856256763ef38b64661c0aa7f2dd95e3316c2651f7953d507b00","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:55a61b280575b4ebdd9386d74c949cf23e5fffeeb984aca45801a917651c778e":{"type":"File","value":"55a61b280575b4ebdd9386d74c949cf23e5fffeeb984aca45801a917651c778e"},"File:57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11":{"type":"File","value":"57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8":{"type":"File","value":"58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8"},"File:5c68f07fd5b26cbdefb819be95e9965a6e5086d71241e703cb92976089724a90":{"type":"File","value":"5c68f07fd5b26cbdefb819be95e9965a6e5086d71241e703cb92976089724a90"},"File:5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb":{"type":"File","value":"5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4":{"type":"File","value":"5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:5f016267aec3bb25bae0e00562c8e53d3ff732769f0d8094936e3338686e13e1":{"type":"File","value":"5f016267aec3bb25bae0e00562c8e53d3ff732769f0d8094936e3338686e13e1","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8":{"type":"File","value":"5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a":{"type":"File","value":"613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb":{"type":"File","value":"63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","filetype":"PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 9 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479":{"type":"File","value":"640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475":{"type":"File","value":"6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:6d41bd2d5380b6ca0eedea7a07191562bbfe2c06ca1868c82dd67a1934733192":{"type":"File","value":"6d41bd2d5380b6ca0eedea7a07191562bbfe2c06ca1868c82dd67a1934733192"},"File:7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a":{"type":"File","value":"7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:729fd64f661d8b34321e57bed297201818cc5f5984b453900296d179ce0dcfb5":{"type":"File","value":"729fd64f661d8b34321e57bed297201818cc5f5984b453900296d179ce0dcfb5"},"File:72c253ed45ca7258fb867bf43f765c8db067534d110ff35b9dda7b42c8fcea1b":{"type":"File","value":"72c253ed45ca7258fb867bf43f765c8db067534d110ff35b9dda7b42c8fcea1b","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:762de3879f1c6ada1cb36bbc78766d45e01150a2cf0edbc9abf9f7ebfdaf08eb":{"type":"File","value":"762de3879f1c6ada1cb36bbc78766d45e01150a2cf0edbc9abf9f7ebfdaf08eb"},"File:788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458":{"type":"File","value":"788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b":{"type":"File","value":"7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad":{"type":"File","value":"7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:7f39c2e7557d3063cae12f7ae9171cbf737c9d95fa12a98974081c46fcbfcaba":{"type":"File","value":"7f39c2e7557d3063cae12f7ae9171cbf737c9d95fa12a98974081c46fcbfcaba","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb":{"type":"File","value":"8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8050e9ac428ec2418ae0d5256f74d500fa1f969d877bf5cb4111258fdd2c0fa7":{"type":"File","value":"8050e9ac428ec2418ae0d5256f74d500fa1f969d877bf5cb4111258fdd2c0fa7","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:80f55a1a1858dad8d49caba8e48159ad522056e1fe84ae2788e16fcdcf3eaeb6":{"type":"File","value":"80f55a1a1858dad8d49caba8e48159ad522056e1fe84ae2788e16fcdcf3eaeb6","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028":{"type":"File","value":"833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:84ee4137a311fca29c1fafa618c0e17e876b02d7a78763919ea78b70602e622d":{"type":"File","value":"84ee4137a311fca29c1fafa618c0e17e876b02d7a78763919ea78b70602e622d","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433":{"type":"File","value":"855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7":{"type":"File","value":"868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8746d8fd6ada8cbe31803644f785461a58d6b89812f40325cd493c155e57ad97":{"type":"File","value":"8746d8fd6ada8cbe31803644f785461a58d6b89812f40325cd493c155e57ad97"},"File:87821dc11890cf86b0c467bc5ace7910cfb8fd4954e4b312ff05350dd4c38f9f":{"type":"File","value":"87821dc11890cf86b0c467bc5ace7910cfb8fd4954e4b312ff05350dd4c38f9f","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:87f5578925154ec2d2b52b189f3cf27caf1d3abc29f4b5fbe4bbfee746c2c3eb":{"type":"File","value":"87f5578925154ec2d2b52b189f3cf27caf1d3abc29f4b5fbe4bbfee746c2c3eb"},"File:8ef006c27c923ae061eda5bd491fdc6aeb7a111f316ee916023f9cae1f96df5a":{"type":"File","value":"8ef006c27c923ae061eda5bd491fdc6aeb7a111f316ee916023f9cae1f96df5a","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:90e91fdf1cfc6eee3ee88bc497a24ede6847351350c63f92ca7909c8270ea64d":{"type":"File","value":"90e91fdf1cfc6eee3ee88bc497a24ede6847351350c63f92ca7909c8270ea64d"},"File:92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976":{"type":"File","value":"92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9":{"type":"File","value":"92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:9342b3250c695d1a0a47c8fa5d9b212c9072420f6238ecbd9f316753477f8df9":{"type":"File","value":"9342b3250c695d1a0a47c8fa5d9b212c9072420f6238ecbd9f316753477f8df9","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:967fe671582dca8bb9ed3faf7b6848f9407e2bb4d43e3d6ddb16fd32590395e1":{"type":"File","value":"967fe671582dca8bb9ed3faf7b6848f9407e2bb4d43e3d6ddb16fd32590395e1"},"File:97efcd587b02cfd00c1f0c03f4f8b9878ac97207b54f07168dd113de41b57123":{"type":"File","value":"97efcd587b02cfd00c1f0c03f4f8b9878ac97207b54f07168dd113de41b57123","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:9abdbcc365706c34a59691435c3b5e3f09e1c2cef154e4ce54f0ccf1bd58dd2c":{"type":"File","value":"9abdbcc365706c34a59691435c3b5e3f09e1c2cef154e4ce54f0ccf1bd58dd2c","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:9c46194218f43c3eaaaa46a1fdd822f81b331ad94bf531287917cada4f9b09d4":{"type":"File","value":"9c46194218f43c3eaaaa46a1fdd822f81b331ad94bf531287917cada4f9b09d4"},"File:9cc00535722f7d0239d520659ec380e525a27124f6dd67a428d5dfd31a85099f":{"type":"File","value":"9cc00535722f7d0239d520659ec380e525a27124f6dd67a428d5dfd31a85099f","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562":{"type":"File","value":"a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:a65fc761c411044ffe4b74262bc772e93dff388199d76197ead3d83b48bfd600":{"type":"File","value":"a65fc761c411044ffe4b74262bc772e93dff388199d76197ead3d83b48bfd600"},"File:a9e40c756c9411f079764debb22c8dac7b4c72c498c0d157e2936307f7be2cad":{"type":"File","value":"a9e40c756c9411f079764debb22c8dac7b4c72c498c0d157e2936307f7be2cad","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:aa98b84691dcfa8df31028e855dae3ef478bdd913b1584f5d7fa2114d5aae3b9":{"type":"File","value":"aa98b84691dcfa8df31028e855dae3ef478bdd913b1584f5d7fa2114d5aae3b9"},"File:abdb12bcf970c0e8ad2a34d75db67b7ae64a48d6b1378af464edf5952ed49629":{"type":"File","value":"abdb12bcf970c0e8ad2a34d75db67b7ae64a48d6b1378af464edf5952ed49629","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:acd8a446eebb120af0b63dcfaa6567d87c38ee65103a7d208b8161c05a5170ba":{"type":"File","value":"acd8a446eebb120af0b63dcfaa6567d87c38ee65103a7d208b8161c05a5170ba","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:adca25222a9dd204b70b75739f3fb05206ac3bc8a96a675fb386533747e25b62":{"type":"File","value":"adca25222a9dd204b70b75739f3fb05206ac3bc8a96a675fb386533747e25b62"},"File:b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44":{"type":"File","value":"b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44"},"File:b0b426b68bb0913537dfe9180ac3960339f7aa03fa9c531dca7534b0f90bed69":{"type":"File","value":"b0b426b68bb0913537dfe9180ac3960339f7aa03fa9c531dca7534b0f90bed69","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:b17ff71e85d21247dfe1a00d9507cd65f3ad8d2c0ee0e6ded90954e96871a22d":{"type":"File","value":"b17ff71e85d21247dfe1a00d9507cd65f3ad8d2c0ee0e6ded90954e96871a22d"},"File:b2b4fcb39e4ed697febabf08cbc849605ef0d0567ccabaabb0fac53ee568d955":{"type":"File","value":"b2b4fcb39e4ed697febabf08cbc849605ef0d0567ccabaabb0fac53ee568d955"},"File:b3534dbc5f84524d8bcb2e64a083a579c4f62eb30bf7ce16b417e2e177a04bbd":{"type":"File","value":"b3534dbc5f84524d8bcb2e64a083a579c4f62eb30bf7ce16b417e2e177a04bbd"},"File:b4c87784e4abbfd3dc284b11a1e8a7995bd395e8ffa500bd65650826f2e73de1":{"type":"File","value":"b4c87784e4abbfd3dc284b11a1e8a7995bd395e8ffa500bd65650826f2e73de1"},"File:b713f6a2bb6098b1d4e2fc37b6dadf98dacf181711320628d88ec5b7a177c182":{"type":"File","value":"b713f6a2bb6098b1d4e2fc37b6dadf98dacf181711320628d88ec5b7a177c182","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773":{"type":"File","value":"b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:b7f379a14ca42e702f646755cdb6356e68b47ca18cebc783cb9e0a7160470a48":{"type":"File","value":"b7f379a14ca42e702f646755cdb6356e68b47ca18cebc783cb9e0a7160470a48"},"File:bc1abfacae076996912cd20250f5829ab646f79f0303ce9f3c90cb260e61b310":{"type":"File","value":"bc1abfacae076996912cd20250f5829ab646f79f0303ce9f3c90cb260e61b310"},"File:bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770":{"type":"File","value":"bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:bdd27b72c25ada8bd8fdf5a732589cbe4d7c2b6e70cd04a5df8943acc8c1321d":{"type":"File","value":"bdd27b72c25ada8bd8fdf5a732589cbe4d7c2b6e70cd04a5df8943acc8c1321d"},"File:befc9a19c804bc06eb2d03793164e5e25a78d3a2d4886054da02f9c5dcd43d54":{"type":"File","value":"befc9a19c804bc06eb2d03793164e5e25a78d3a2d4886054da02f9c5dcd43d54"},"File:c1b4d9fbdb818ad4d3efd1c69ca6b94634dec0f413736a8d14c7f378df82fcb4":{"type":"File","value":"c1b4d9fbdb818ad4d3efd1c69ca6b94634dec0f413736a8d14c7f378df82fcb4"},"File:c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5":{"type":"File","value":"c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:c582e91a6ea31bc9f0479d3a85dfcb3b80c389011942dd878087fadb9857565a":{"type":"File","value":"c582e91a6ea31bc9f0479d3a85dfcb3b80c389011942dd878087fadb9857565a","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:c6da94553fbf27256a2f144eae834b394db37e214834f1ac5afca8d1c6bb1c44":{"type":"File","value":"c6da94553fbf27256a2f144eae834b394db37e214834f1ac5afca8d1c6bb1c44","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:c77597244698cfbc79c12a2aaf66d44c11c19ec67669b208ab3a38b5a9be2c2a":{"type":"File","value":"c77597244698cfbc79c12a2aaf66d44c11c19ec67669b208ab3a38b5a9be2c2a"},"File:c8596ad4d200c35870975dffef0e263ead11d2f888481a40a3fce7990cbc3f88":{"type":"File","value":"c8596ad4d200c35870975dffef0e263ead11d2f888481a40a3fce7990cbc3f88"},"File:c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4":{"type":"File","value":"c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f":{"type":"File","value":"c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:cb715cc1771a4a1e9f682666d9fdf30085a656386cb2df2cbadb62bad3346e7d":{"type":"File","value":"cb715cc1771a4a1e9f682666d9fdf30085a656386cb2df2cbadb62bad3346e7d"},"File:cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15":{"type":"File","value":"cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:cdca66d6d7d936dc881230868703094abbbeecd946268f7f52af729472619b4e":{"type":"File","value":"cdca66d6d7d936dc881230868703094abbbeecd946268f7f52af729472619b4e"},"File:d161558c87ff680b148baaa8eb5b99b6641675967c9a4a53a330067321c50394":{"type":"File","value":"d161558c87ff680b148baaa8eb5b99b6641675967c9a4a53a330067321c50394"},"File:d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529":{"type":"File","value":"d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b":{"type":"File","value":"d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:d3affe9879840d2dcc318809c3bff6e64a276b2d8ec5fcf8deea230c43c55bac":{"type":"File","value":"d3affe9879840d2dcc318809c3bff6e64a276b2d8ec5fcf8deea230c43c55bac"},"File:d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1":{"type":"File","value":"d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac":{"type":"File","value":"d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac","filetype":"PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:d5265a2716c09f0875aed7f2a525cee877110bd9d9c510f94365f6b65ab28511":{"type":"File","value":"d5265a2716c09f0875aed7f2a525cee877110bd9d9c510f94365f6b65ab28511"},"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066":{"type":"File","value":"d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e":{"type":"File","value":"d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:d86b012db5c5b714575ac5cd4a363ad4aca2426323e1e645c1f467ad9c9dbc25":{"type":"File","value":"d86b012db5c5b714575ac5cd4a363ad4aca2426323e1e645c1f467ad9c9dbc25"},"File:dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab":{"type":"File","value":"dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827":{"type":"File","value":"dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:dedec69862470eeee6d310a0c58cf1ee63a0a6b5f15e385d1f24bd3fee28c494":{"type":"File","value":"dedec69862470eeee6d310a0c58cf1ee63a0a6b5f15e385d1f24bd3fee28c494","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e0571b9499ffcbaa4fce8530208d513ced9cb4479ae8caebaa32475891c81d50":{"type":"File","value":"e0571b9499ffcbaa4fce8530208d513ced9cb4479ae8caebaa32475891c81d50"},"File:e093f4d617dd64754d899370efaaeb3f3a77463c02f90d4aa688906118f25ca3":{"type":"File","value":"e093f4d617dd64754d899370efaaeb3f3a77463c02f90d4aa688906118f25ca3","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e0c03aa9d6c8c9010f8fce517511524401711504855592b0f0703c137a915a5f":{"type":"File","value":"e0c03aa9d6c8c9010f8fce517511524401711504855592b0f0703c137a915a5f"},"File:e0cc30956fa5b83cf2818aa66391297817a3fa20b7a0a93aeb3c1e2226550ffb":{"type":"File","value":"e0cc30956fa5b83cf2818aa66391297817a3fa20b7a0a93aeb3c1e2226550ffb"},"File:e25d2c314cc152c6b550cd7aa62303fe201bd089ed6d87e35d20b0717d79c0b5":{"type":"File","value":"e25d2c314cc152c6b550cd7aa62303fe201bd089ed6d87e35d20b0717d79c0b5"},"File:e2ffeac820b5da39448f2d2bc7a1c14db2c268b0316d482c3573be67afe3ac84":{"type":"File","value":"e2ffeac820b5da39448f2d2bc7a1c14db2c268b0316d482c3573be67afe3ac84","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e307486c9b8dcaafdefec148e6890f7ebcc2fe1a5fedf18f670cc0c3056bc9e4":{"type":"File","value":"e307486c9b8dcaafdefec148e6890f7ebcc2fe1a5fedf18f670cc0c3056bc9e4"},"File:e390ea667e89ae6d1567dc263e568837c763093c0c2b5ca8344d0488ee06248d":{"type":"File","value":"e390ea667e89ae6d1567dc263e568837c763093c0c2b5ca8344d0488ee06248d","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a":{"type":"File","value":"e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1":{"type":"File","value":"e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:e7694445baf099c95b12c2fde771c1948fb5616985f847505b651d77a45579c6":{"type":"File","value":"e7694445baf099c95b12c2fde771c1948fb5616985f847505b651d77a45579c6","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f":{"type":"File","value":"e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:ec7d880ea488601e416054e6a0845a3739f6db6dae0c55267d0a48830d27b137":{"type":"File","value":"ec7d880ea488601e416054e6a0845a3739f6db6dae0c55267d0a48830d27b137"},"File:ed51177af8c9d7af6def523e4dd812df038dfaa7ff575ef526d8d06d11867df8":{"type":"File","value":"ed51177af8c9d7af6def523e4dd812df038dfaa7ff575ef526d8d06d11867df8","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:edcaf1fbb669fd8e5aa88b0976cb59a0a2e6c14f52947e09beb31e4b6ccad543":{"type":"File","value":"edcaf1fbb669fd8e5aa88b0976cb59a0a2e6c14f52947e09beb31e4b6ccad543"},"File:ef1724edf3763340b6eb3b1188a62291bdb7b71156d6775e8326daf3733e7f5c":{"type":"File","value":"ef1724edf3763340b6eb3b1188a62291bdb7b71156d6775e8326daf3733e7f5c"},"File:efe4243ef67767b0b330ce5cecc5915f1d525672306f1ed1ee6c253d685a94eb":{"type":"File","value":"efe4243ef67767b0b330ce5cecc5915f1d525672306f1ed1ee6c253d685a94eb"},"File:f026cf55abfd3f108432e24d93da11cb4d9bcde5fe1cb1f1ee82601a415522ba":{"type":"File","value":"f026cf55abfd3f108432e24d93da11cb4d9bcde5fe1cb1f1ee82601a415522ba","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f094226e4bbc5b101ee6ae183232bbab651978a2e92a5acd84fd3e0f40cb6da2":{"type":"File","value":"f094226e4bbc5b101ee6ae183232bbab651978a2e92a5acd84fd3e0f40cb6da2","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193":{"type":"File","value":"f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:f4594878d0fde564d3a519ea1ac2c6c352cad4a1f26c80142c6278e6d4b76bf6":{"type":"File","value":"f4594878d0fde564d3a519ea1ac2c6c352cad4a1f26c80142c6278e6d4b76bf6","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f53eeb91b39c9bd6549305d9123e2075414a84c25416a0e50c18fbee548309c3":{"type":"File","value":"f53eeb91b39c9bd6549305d9123e2075414a84c25416a0e50c18fbee548309c3"},"File:f5885ff686cdf5c812bc32854089509f3bab5306ec60fcce761fb967ba522d5f":{"type":"File","value":"f5885ff686cdf5c812bc32854089509f3bab5306ec60fcce761fb967ba522d5f","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95":{"type":"File","value":"f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9":{"type":"File","value":"f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f7a62aa0ff3a82b6761096dfaf08361d252b61f0fb0ef2d1b0ad3a4f4275b724":{"type":"File","value":"f7a62aa0ff3a82b6761096dfaf08361d252b61f0fb0ef2d1b0ad3a4f4275b724","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f7e0c554af1085854625caecf81aa08175f55e2d5224b3b5d034a6f3495edf58":{"type":"File","value":"f7e0c554af1085854625caecf81aa08175f55e2d5224b3b5d034a6f3495edf58"},"File:f8b6eb3e0ac2af579d315ea46d03eb47719a252ff78c59c3d34bfd39b593b71a":{"type":"File","value":"f8b6eb3e0ac2af579d315ea46d03eb47719a252ff78c59c3d34bfd39b593b71a"},"File:f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b":{"type":"File","value":"f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b","filetype":"PE32+ executable (DLL) (console) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535":{"type":"File","value":"fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:fd4b3472c452730b250f1ad7284af45f758bc8370c0687a6020054072c551cc2":{"type":"File","value":"fd4b3472c452730b250f1ad7284af45f758bc8370c0687a6020054072c551cc2"},"File:fe1ead43adb4ba2d3a5badf9372d35a49fa94affa7ea019c46d399c80e912713":{"type":"File","value":"fe1ead43adb4ba2d3a5badf9372d35a49fa94affa7ea019c46d399c80e912713"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.74.13":{"type":"Ip","value":"150.171.74.13"},"Ip:23.46.228.101":{"type":"Ip","value":"23.46.228.101"},"Ip:23.56.109.209":{"type":"Ip","value":"23.56.109.209"},"Ip:23.61.246.220":{"type":"Ip","value":"23.61.246.220"},"Ip:3.171.117.62":{"type":"Ip","value":"3.171.117.62"},"Ip:77.72.1.28":{"type":"Ip","value":"77.72.1.28"},"Url:/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US":{"type":"Url","value":"/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US"},"Url:/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US":{"type":"Url","value":"/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US"},"Url:/comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US":{"type":"Url","value":"/comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US"},"Url:/comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US":{"type":"Url","value":"/comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US"},"Url:/favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/files/milkdrop_presets_4.7z":{"type":"Url","value":"/files/milkdrop_presets_4.7z"},"Url:/files/vgmstream64_ffmpeg_1.7z":{"type":"Url","value":"/files/vgmstream64_ffmpeg_1.7z"},"Url:/versions.json":{"type":"Url","value":"/versions.json"}},"chains":[{"id":"1562976618328522411","root":"Domain:64bb032e7a8ff3f00311bf4fd34d94b1bc8a22ee00f080f2e5c1d17c27e851e9","edges":[],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1562976613702197205","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197233","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:085ba6705e6420e44518d437aa45b8304319bd9f433e601f7e373a62a98d4d24"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197227","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391550","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002890","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387465","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197222","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:17d6ef28c1f6ac2fead5f2ff2a2e5ac204a4854a429a543032a6407a0d9ed2ef"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197218","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391549","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002896","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002886","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:25046cd6057ba1ef9ef01b69f9e919ea1159fde9e951ccad13a8d27ca19d32ec"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197213","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:28e673356267d156b1524169b6d954690b9e63ca3824fa28edcc3609214ed9dc"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197229","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:290ea771ea62282e55b40e67bd6779d7a15aa9d9a7ead0a07acb6bf2b30cb928"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581785","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2a1e8ba097b8e41394a4434e9df579b15716e6b717ca487f1c9fc7d328da4d9e"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002887","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197223","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197208","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581779","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33b740d0ed92d0d68ae7bfbda0963d16acb6df5c7f7ebf5d4749a453bcab2a55"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387459","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197225","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581773","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581782","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:44c2043b90af0b5c57189a474102530a31b098e40ab2ca5fafa56ac57e5575df"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197215","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391543","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4b6bec03b6150595cc5fc695e0f2f7fac03c5f0f6c2f0b92f8c1a9d1b85961ce"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002893","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197212","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391548","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197210","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:51be2a6cb12211f359fa8b4c375a423cf72378b2bbf6737e29352bdfa6bb234d"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197226","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:544e919612b6856256763ef38b64661c0aa7f2dd95e3316c2651f7953d507b00"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387458","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581783","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002881","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5f016267aec3bb25bae0e00562c8e53d3ff732769f0d8094936e3338686e13e1"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002894","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581778","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613693808568","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002895","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002897","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:72c253ed45ca7258fb867bf43f765c8db067534d110ff35b9dda7b42c8fcea1b"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002878","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197231","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581774","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002877","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7f39c2e7557d3063cae12f7ae9171cbf737c9d95fa12a98974081c46fcbfcaba"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581784","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387463","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8050e9ac428ec2418ae0d5256f74d500fa1f969d877bf5cb4111258fdd2c0fa7"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613693808569","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:80f55a1a1858dad8d49caba8e48159ad522056e1fe84ae2788e16fcdcf3eaeb6"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197221","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002882","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:84ee4137a311fca29c1fafa618c0e17e876b02d7a78763919ea78b70602e622d"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391542","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002875","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002879","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:87821dc11890cf86b0c467bc5ace7910cfb8fd4954e4b312ff05350dd4c38f9f"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197220","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8ef006c27c923ae061eda5bd491fdc6aeb7a111f316ee916023f9cae1f96df5a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197216","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391551","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391545","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9342b3250c695d1a0a47c8fa5d9b212c9072420f6238ecbd9f316753477f8df9"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581772","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:97efcd587b02cfd00c1f0c03f4f8b9878ac97207b54f07168dd113de41b57123"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581781","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9abdbcc365706c34a59691435c3b5e3f09e1c2cef154e4ce54f0ccf1bd58dd2c"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197219","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9cc00535722f7d0239d520659ec380e525a27124f6dd67a428d5dfd31a85099f"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197214","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002898","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a9e40c756c9411f079764debb22c8dac7b4c72c498c0d157e2936307f7be2cad"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197209","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:abdb12bcf970c0e8ad2a34d75db67b7ae64a48d6b1378af464edf5952ed49629"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197236","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:acd8a446eebb120af0b63dcfaa6567d87c38ee65103a7d208b8161c05a5170ba"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002883","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b0b426b68bb0913537dfe9180ac3960339f7aa03fa9c531dca7534b0f90bed69"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391541","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b713f6a2bb6098b1d4e2fc37b6dadf98dacf181711320628d88ec5b7a177c182"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002880","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002885","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581771","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581777","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c582e91a6ea31bc9f0479d3a85dfcb3b80c389011942dd878087fadb9857565a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002889","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c6da94553fbf27256a2f144eae834b394db37e214834f1ac5afca8d1c6bb1c44"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002876","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002884","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197235","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002891","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197217","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581775","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391544","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387460","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002888","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dedec69862470eeee6d310a0c58cf1ee63a0a6b5f15e385d1f24bd3fee28c494"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197207","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e093f4d617dd64754d899370efaaeb3f3a77463c02f90d4aa688906118f25ca3"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197230","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e2ffeac820b5da39448f2d2bc7a1c14db2c268b0316d482c3573be67afe3ac84"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387457","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e390ea667e89ae6d1567dc263e568837c763093c0c2b5ca8344d0488ee06248d"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197234","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197211","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e7694445baf099c95b12c2fde771c1948fb5616985f847505b651d77a45579c6"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197232","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387456","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:ed51177af8c9d7af6def523e4dd812df038dfaa7ff575ef526d8d06d11867df8"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387464","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f026cf55abfd3f108432e24d93da11cb4d9bcde5fe1cb1f1ee82601a415522ba"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581776","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f094226e4bbc5b101ee6ae183232bbab651978a2e92a5acd84fd3e0f40cb6da2"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197206","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f4594878d0fde564d3a519ea1ac2c6c352cad4a1f26c80142c6278e6d4b76bf6"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197228","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f5885ff686cdf5c812bc32854089509f3bab5306ec60fcce761fb967ba522d5f"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002899","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387462","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002892","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f7a62aa0ff3a82b6761096dfaf08361d252b61f0fb0ef2d1b0ad3a4f4275b724"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581780","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391546","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f"},{"edge_kind":"extracted_from_archive","from_key":"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f","to_key":"File:d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706387461","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa"},{"edge_kind":"extracted_from_archive","from_key":"File:219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa","to_key":"File:276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613706391547","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48"},{"edge_kind":"extracted_from_archive","from_key":"File:2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48","to_key":"File:2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613698002874","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb"},{"edge_kind":"extracted_from_archive","from_key":"File:5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb","to_key":"File:e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197204","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479"},{"edge_kind":"extracted_from_archive","from_key":"File:640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479","to_key":"File:f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613702197224","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066"},{"edge_kind":"extracted_from_archive","from_key":"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066","to_key":"File:d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529"}],"verdict":{"verdict":"unknown"}},{"id":"1562976613710581770","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b"},{"edge_kind":"extracted_from_archive","from_key":"File:f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b","to_key":"File:4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:77.72.1.28"},{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:23.61.246.220"},{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:23.46.228.101"},{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:3.171.117.62"},{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_ip","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Ip:23.56.109.209"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:ecn.dev.virtualearth.net"},{"edge_kind":"resolves_to","from_key":"Domain:ecn.dev.virtualearth.net","to_key":"Ip:23.46.228.101"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:getwacup.com"},{"edge_kind":"resolves_to","from_key":"Domain:getwacup.com","to_key":"Ip:77.72.1.28"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:3.171.117.62"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_domain","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Domain:t.ssl.ak.dynamic.tiles.virtualearth.net"},{"edge_kind":"resolves_to","from_key":"Domain:t.ssl.ak.dynamic.tiles.virtualearth.net","to_key":"Ip:23.56.109.209"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/files/vgmstream64_ffmpeg_1.7z"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/files/milkdrop_presets_4.7z"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/versions.json"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"Url:/favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","edges":[{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:44c2043b90af0b5c57189a474102530a31b098e40ab2ca5fafa56ac57e5575df"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e2ffeac820b5da39448f2d2bc7a1c14db2c268b0316d482c3573be67afe3ac84"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:51be2a6cb12211f359fa8b4c375a423cf72378b2bbf6737e29352bdfa6bb234d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a9e40c756c9411f079764debb22c8dac7b4c72c498c0d157e2936307f7be2cad"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9abdbcc365706c34a59691435c3b5e3f09e1c2cef154e4ce54f0ccf1bd58dd2c"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5f016267aec3bb25bae0e00562c8e53d3ff732769f0d8094936e3338686e13e1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33b740d0ed92d0d68ae7bfbda0963d16acb6df5c7f7ebf5d4749a453bcab2a55"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:abdb12bcf970c0e8ad2a34d75db67b7ae64a48d6b1378af464edf5952ed49629"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8050e9ac428ec2418ae0d5256f74d500fa1f969d877bf5cb4111258fdd2c0fa7"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:544e919612b6856256763ef38b64661c0aa7f2dd95e3316c2651f7953d507b00"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e7694445baf099c95b12c2fde771c1948fb5616985f847505b651d77a45579c6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b713f6a2bb6098b1d4e2fc37b6dadf98dacf181711320628d88ec5b7a177c182"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f4594878d0fde564d3a519ea1ac2c6c352cad4a1f26c80142c6278e6d4b76bf6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e390ea667e89ae6d1567dc263e568837c763093c0c2b5ca8344d0488ee06248d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2a1e8ba097b8e41394a4434e9df579b15716e6b717ca487f1c9fc7d328da4d9e"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e093f4d617dd64754d899370efaaeb3f3a77463c02f90d4aa688906118f25ca3"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4b6bec03b6150595cc5fc695e0f2f7fac03c5f0f6c2f0b92f8c1a9d1b85961ce"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c582e91a6ea31bc9f0479d3a85dfcb3b80c389011942dd878087fadb9857565a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f5885ff686cdf5c812bc32854089509f3bab5306ec60fcce761fb967ba522d5f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:ed51177af8c9d7af6def523e4dd812df038dfaa7ff575ef526d8d06d11867df8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9342b3250c695d1a0a47c8fa5d9b212c9072420f6238ecbd9f316753477f8df9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:085ba6705e6420e44518d437aa45b8304319bd9f433e601f7e373a62a98d4d24"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f7a62aa0ff3a82b6761096dfaf08361d252b61f0fb0ef2d1b0ad3a4f4275b724"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:72c253ed45ca7258fb867bf43f765c8db067534d110ff35b9dda7b42c8fcea1b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:97efcd587b02cfd00c1f0c03f4f8b9878ac97207b54f07168dd113de41b57123"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:25046cd6057ba1ef9ef01b69f9e919ea1159fde9e951ccad13a8d27ca19d32ec"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:80f55a1a1858dad8d49caba8e48159ad522056e1fe84ae2788e16fcdcf3eaeb6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:acd8a446eebb120af0b63dcfaa6567d87c38ee65103a7d208b8161c05a5170ba"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7f39c2e7557d3063cae12f7ae9171cbf737c9d95fa12a98974081c46fcbfcaba"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:290ea771ea62282e55b40e67bd6779d7a15aa9d9a7ead0a07acb6bf2b30cb928"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f026cf55abfd3f108432e24d93da11cb4d9bcde5fe1cb1f1ee82601a415522ba"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:87821dc11890cf86b0c467bc5ace7910cfb8fd4954e4b312ff05350dd4c38f9f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b0b426b68bb0913537dfe9180ac3960339f7aa03fa9c531dca7534b0f90bed69"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:84ee4137a311fca29c1fafa618c0e17e876b02d7a78763919ea78b70602e622d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dedec69862470eeee6d310a0c58cf1ee63a0a6b5f15e385d1f24bd3fee28c494"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9cc00535722f7d0239d520659ec380e525a27124f6dd67a428d5dfd31a85099f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:28e673356267d156b1524169b6d954690b9e63ca3824fa28edcc3609214ed9dc"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8ef006c27c923ae061eda5bd491fdc6aeb7a111f316ee916023f9cae1f96df5a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f094226e4bbc5b101ee6ae183232bbab651978a2e92a5acd84fd3e0f40cb6da2"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c6da94553fbf27256a2f144eae834b394db37e214834f1ac5afca8d1c6bb1c44"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:17d6ef28c1f6ac2fead5f2ff2a2e5ac204a4854a429a543032a6407a0d9ed2ef"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:142939fdd15ffdb658cb27926c1ab99b573df22330eecd81b31b531a808a0ad4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2a303ab60c40124efc793b7facdccf581524d271f8c48f7cff84794ae70a09e3"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0e822bd2062f234a2272846e0a52f7e30d60631ca8aed010a21a636319cefc6e"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0bc5624723725ed188ac781b9b9e8faef90921bfb3cb7efb2dce6bf9aead00b5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c1b4d9fbdb818ad4d3efd1c69ca6b94634dec0f413736a8d14c7f378df82fcb4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5c68f07fd5b26cbdefb819be95e9965a6e5086d71241e703cb92976089724a90"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:729fd64f661d8b34321e57bed297201818cc5f5984b453900296d179ce0dcfb5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:cb715cc1771a4a1e9f682666d9fdf30085a656386cb2df2cbadb62bad3346e7d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:52ac9cf92558bca053ae8ec95c87ec2e7b39d3ca8e013676060a2f3b6adb4930"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:8746d8fd6ada8cbe31803644f785461a58d6b89812f40325cd493c155e57ad97"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e0c03aa9d6c8c9010f8fce517511524401711504855592b0f0703c137a915a5f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:506f80f779dd95419a8fbda3cabd770614046b64b1be0455b62558664db85f4f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:87f5578925154ec2d2b52b189f3cf27caf1d3abc29f4b5fbe4bbfee746c2c3eb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:cdca66d6d7d936dc881230868703094abbbeecd946268f7f52af729472619b4e"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1c9247245e63dd20b406de29520f77c98967a0a3a96c940ea2ebdd6eee9280bc"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:fd4b3472c452730b250f1ad7284af45f758bc8370c0687a6020054072c551cc2"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:edcaf1fbb669fd8e5aa88b0976cb59a0a2e6c14f52947e09beb31e4b6ccad543"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:14c37023ea67ec68d121d13866e1af5657af3a58665a9308f6b372652b349344"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:befc9a19c804bc06eb2d03793164e5e25a78d3a2d4886054da02f9c5dcd43d54"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:fe1ead43adb4ba2d3a5badf9372d35a49fa94affa7ea019c46d399c80e912713"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e0cc30956fa5b83cf2818aa66391297817a3fa20b7a0a93aeb3c1e2226550ffb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:39a3771040889cd5687886a47673e463fc1c11f0912db3037be6a723eea24e05"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:a65fc761c411044ffe4b74262bc772e93dff388199d76197ead3d83b48bfd600"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3af24743b2706303a9f32cc31c4991d88280757eaa61060bfdf7bea751cc6273"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:6d41bd2d5380b6ca0eedea7a07191562bbfe2c06ca1868c82dd67a1934733192"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:967fe671582dca8bb9ed3faf7b6848f9407e2bb4d43e3d6ddb16fd32590395e1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:ef1724edf3763340b6eb3b1188a62291bdb7b71156d6775e8326daf3733e7f5c"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c8596ad4d200c35870975dffef0e263ead11d2f888481a40a3fce7990cbc3f88"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:bdd27b72c25ada8bd8fdf5a732589cbe4d7c2b6e70cd04a5df8943acc8c1321d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:32af8ca41c4cfce9a7ffac402ebdced89d3328d0072bcc371301663e478b7c9b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:9c46194218f43c3eaaaa46a1fdd822f81b331ad94bf531287917cada4f9b09d4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:00cbabc8e73828b65f10d452e1856e5eb03147c89c16812e815c5e7d5b968de9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:488cbafbee826ad9d32d86508b53b067504cae31ec1ebf271c402ccd34a9b9fb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d161558c87ff680b148baaa8eb5b99b6641675967c9a4a53a330067321c50394"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b17ff71e85d21247dfe1a00d9507cd65f3ad8d2c0ee0e6ded90954e96871a22d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:30fd4f5574658d34eeaacb5201ece6c9810ce1fa4fc76b6cbee7f0c83cb390e8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f7e0c554af1085854625caecf81aa08175f55e2d5224b3b5d034a6f3495edf58"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:091ed228d2928e22e5e4cc8674207692544093f2ff81f0435f3b94669b44dce7"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:55a61b280575b4ebdd9386d74c949cf23e5fffeeb984aca45801a917651c778e"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:ec7d880ea488601e416054e6a0845a3739f6db6dae0c55267d0a48830d27b137"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b7f379a14ca42e702f646755cdb6356e68b47ca18cebc783cb9e0a7160470a48"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:bc1abfacae076996912cd20250f5829ab646f79f0303ce9f3c90cb260e61b310"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d3affe9879840d2dcc318809c3bff6e64a276b2d8ec5fcf8deea230c43c55bac"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b3534dbc5f84524d8bcb2e64a083a579c4f62eb30bf7ce16b417e2e177a04bbd"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:26b2087aaa7630a5faa4a60460f7310829990aa97bc090c13f05cdc180e71a32"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:2a0e91c2370abf93781dabbbfdb1d7bd459f4c212710006172ab8581db8b3dec"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d5265a2716c09f0875aed7f2a525cee877110bd9d9c510f94365f6b65ab28511"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:481929a6a64704835eb84e8929941ae6f22545c682d21e41a3adb6a14c577074"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:349017bdf3c8a522cc9a9085b48639c8b37a17e829b3199e8b766455b8ff2879"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:46500d39474293eb3b830eae2cf42bf2a049544e84dfe1458ce155153adf7b89"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e25d2c314cc152c6b550cd7aa62303fe201bd089ed6d87e35d20b0717d79c0b5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1aefa74e576383ac2ba641a467731116d57f822e17820565f96c4479d516d5ad"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:1721e50bfd45f4fb4134b07f344b859d4a89626b88552c15a45b6514810aef21"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:adca25222a9dd204b70b75739f3fb05206ac3bc8a96a675fb386533747e25b62"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:762de3879f1c6ada1cb36bbc78766d45e01150a2cf0edbc9abf9f7ebfdaf08eb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:aa98b84691dcfa8df31028e855dae3ef478bdd913b1584f5d7fa2114d5aae3b9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:90e91fdf1cfc6eee3ee88bc497a24ede6847351350c63f92ca7909c8270ea64d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e307486c9b8dcaafdefec148e6890f7ebcc2fe1a5fedf18f670cc0c3056bc9e4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c77597244698cfbc79c12a2aaf66d44c11c19ec67669b208ab3a38b5a9be2c2a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f8b6eb3e0ac2af579d315ea46d03eb47719a252ff78c59c3d34bfd39b593b71a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:246bd5531ff2507702456438d4654c269618d9d5225641c241df47121017f8dc"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:efe4243ef67767b0b330ce5cecc5915f1d525672306f1ed1ee6c253d685a94eb"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0156d660fd266775673b930c7decebb9874e102345d226ca85ec64f15bc3d881"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b2b4fcb39e4ed697febabf08cbc849605ef0d0567ccabaabb0fac53ee568d955"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d86b012db5c5b714575ac5cd4a363ad4aca2426323e1e645c1f467ad9c9dbc25"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f53eeb91b39c9bd6549305d9123e2075414a84c25416a0e50c18fbee548309c3"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4b1e45c1ee0350bb30bad5f5df6dabab10201c7ac1252cd1e0f62861158eea93"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e0571b9499ffcbaa4fce8530208d513ced9cb4479ae8caebaa32475891c81d50"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:14841d2123bf26df2d2d61b60f503840efe5936928670ffef1816eb30928367c"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:b4c87784e4abbfd3dc284b11a1e8a7995bd395e8ffa500bd65650826f2e73de1"},{"edge_kind":"extracted","from_key":"File:63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","to_key":"File:613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":61,"imported_dlls_count":260,"dropped_files_count":0,"extracted_files_count":230,"files_written_count":159,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":6,"contacted_urls_count":16,"http_requests_count":16},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6adaa129a0e9569451057e3d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["GBR","USA"],"submit_name":"WACUP_Preview_v1_99_56_25346_x64.exe","analysis_start_time":"2026-10-22T23:50:04+00:00","indicators_count":{"informative":225,"suspicious":48,"malicious":0},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.72.1.28","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"address":"23.61.246.220","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"address":"23.46.228.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"address":"3.171.117.62","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"address":"150.171.74.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"address":"23.56.109.209","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"dns_resolutions":[{"domain":"ecn.dev.virtualearth.net","address":"23.46.228.101","ttl":2122,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"domain":"getwacup.com","address":"77.72.1.28","ttl":5160,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":2889,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"domain":"sb.scorecardresearch.com","address":"3.171.117.62","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"domain":"services.bingapis.com","address":"150.171.74.13","ttl":2217,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"domain":"t.ssl.ak.dynamic.tiles.virtualearth.net","address":"23.56.109.209","ttl":3381,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"http_requests":[{"host":"getwacup.com","host_ip":"77.72.1.28:443","url":"/files/vgmstream64_ffmpeg_1.7z","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/vgmstream64_ffmpeg_1.7z HTTP/2\nHost: getwacup.com\nUser-Agent: WACUP/\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"getwacup.com","host_ip":"77.72.1.28:443","url":"/files/milkdrop_presets_4.7z","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/milkdrop_presets_4.7z HTTP/2\nHost: getwacup.com\nUser-Agent: WACUP/\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"getwacup.com","host_ip":"77.72.1.28:443","url":"/versions.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /versions.json HTTP/2\nHost: getwacup.com\nUser-Agent: WACUP/1.99.56.25346\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"ecn.dev.virtualearth.net","host_ip":"23.46.228.101:443","url":"/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=276,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2\nHost: ecn.dev.virtualearth.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=2, i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"ecn.dev.virtualearth.net","host_ip":"23.46.228.101:443","url":"/REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/7?mapSize=312,194&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|v:0_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2\nHost: ecn.dev.virtualearth.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=goodhealthrecipes.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"t.ssl.ak.dynamic.tiles.virtualearth.net","host_ip":"23.56.109.209:443","url":"/comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /comp/ch/120202?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US HTTP/2\nHost: t.ssl.ak.dynamic.tiles.virtualearth.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://ntp.msn.com\nPriority: u=1, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=foodnetwork.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"t.ssl.ak.dynamic.tiles.virtualearth.net","host_ip":"23.56.109.209:443","url":"/comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /comp/ch/031313?mkt=en-us&it=Z%2CGF%2CL&shading=hill&og=1655&n=z&subdomain=t3&js=1&cstl=wr&st=me|lv:0_pp|lv:1_nh|lv:0_cr|lv:0_ad|lv:0&nvlos=1&vpt=e,p&pll=1&ell=1&ur=US HTTP/2\nHost: t.ssl.ak.dynamic.tiles.virtualearth.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: cors\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nOrigin: https://ntp.msn.com\nPriority: u=1, i\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=glowcooking.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=onceuponachef.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=healthspectra.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=dietdoctor.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=chefadora.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=theseasonedmom.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=meatchef.net?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"embedded_domains":[{"value":"sourceforge.net","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}],"processes":[{"pid":2044,"ppid":0,"name":"WACUP_Preview_v1_99_56_25346_x64.exe","command_line":"","sha256":"63374b76aab30e1ddc2a07183d19da8be69887acf894ba16e3697e89a0c160cb","normalized_path":"C:\\WACUP_Preview_v1_99_56_25346_x64.exe","uid":"00000000-00002044","icon":"$62"},{"pid":7508,"ppid":0,"name":"wacup.exe","command_line":"/SETUP","sha256":"cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15","normalized_path":"%PROGRAMFILES%\\WACUP\\wacup.exe","uid":"00000000-00007508","icon":"$63"},{"pid":2744,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00002744","icon":"$64"},{"pid":8252,"ppid":2744,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc81880f18,0x7ffc81880f24,0x7ffc81880f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00008252"},{"pid":2656,"ppid":2744,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1872,i,6689281226363075382,10520873275472890126,262144 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2332 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00002656"},{"pid":3052,"ppid":2744,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2172,i,17267208593671850894,2023839072999796564,524288 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2372 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00003052"},{"pid":3040,"ppid":2744,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2040,i,2572956644103581641,8922280230118280874,524288 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2868 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00003040"},{"pid":1912,"ppid":2744,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1792709222719620 --launch-time-ticks=4024999551 --skip-read-main-dll --metrics-shmem-handle=3400,i,697823804383088556,8103060801906708555,2097152 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3460 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00001912"},{"pid":8120,"ppid":2744,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1792709222719620 --launch-time-ticks=4024977605 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3384,i,14143155082793926457,5256052364260284315,2097152 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3388 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00008120"},{"pid":3412,"ppid":2744,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5440,i,16368576414617319806,14484694125751456779,524288 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5472 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00003412"},{"pid":2640,"ppid":2744,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=3752,i,17702403252097310204,219247545222077107,524288 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5448 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002744","uid":"00000000-00002640"},{"pid":3756,"ppid":2744,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6560,i,17366004951463430592,15871695988562350571,524288 --field-trial-handle=2336,i,14202937424425842289,3739128306015628896,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6596 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00002744","uid":"00000000-00003756"}],"all_imported_dlls":["ml_history.dll","winhttp.dll","well_known_domains.dll","KernelBase.dll","sechost.dll","ole32.dll","clbcatq.dll","ml_exporter.dll","gen_exclude.dll","DWrite.dll","atlthunk.dll","rpcrt4.dll","shell32.dll","version.dll","kernel.appcore.dll","wldp.dll","zlib.dll","in_gsf.dll","MMDevAPI.dll","usp10.dll","ml_playlists.dll","msasn1.dll","oneauth.dll","Windows.UI.Immersive.dll","msvcp_win.dll","in_zip.dll","userenv.dll","SHCore.dll","in_qsf.dll","xmllite.dll","dsreg.dll","msedge.dll","slc.dll","mscms.dll","IconCodecService.dll","Windows.Devices.Enumeration.dll","CapabilityAccessManagerClient.dll","d3d10warp.dll","dwmapi.dll","gen_win7shell.dll","SystemSettings.DataModel.dll","gen_wc.dll","crypt32.dll","FirewallAPI.dll","urlmon.dll","in_text.dll","in_what.dll","StructuredQuery.dll","aadWamExtension.dll","in_usf2.dll","gen_bigclock.dll","mfplat.dll","MFMediaEngine.dll","nlaapi.dll","CoreMessaging.dll","libcurl.dll","FWPUCLNT.DLL","RTWorkQ.dll","AssignedAccessRuntime.dll","in_ape.dll","in_dsd.dll","cscapi.dll","OneCoreCommonProxyStub.dll","ml_podcast.dll","Geolocation.dll","d3dcompiler_47.dll","linkinfo.dll","in_2sf.dll","in_hively.dll","DataExchange.dll","Windows.Storage.Search.dll","InputHost.dll","edputil.dll","combase.dll","ws2_32.dll","in_flac.dll","devobj.dll","gen_repeater.dll","IPHLPAPI.DLL","in_vorbis.dll","in_later.dll","ml_ll.dll","in_sc68k.dll","mf.dll","winmm.dll","ResourcePolicyClient.dll","libEGL.dll","DXCore.dll","CoreUIComponents.dll","in_sidious.dll","policymanager.dll","omadmapi.dll","OneCoreUAPCommonProxyStub.dll","bcrypt.dll","gdi32full.dll","comdlg32.dll","sspicli.dll","nde.dll","gen_win10shell.dll","msvcp140.dll","in_notyansf.dll","gen_lyrics.dll","advapi32.dll","iertutil.dll","gen_play_remove.dll","dbghelp.dll","Windows.System.Profile.RetailInfo.dll","winamp.dll","mskeyprotect.dll","in_url.dll","msls31.dll","in_webmkv.dll","dpapi.dll","netprofm.dll","ncrypt.dll","Windows.StateRepositoryPS.dll","in_addanotherplug.dll","wacup_res.dll","gen_jumpex.dll","msedge_elf.dll","telclient.dll","windows.storage.dll","TextShaping.dll","in_wv.dll","gen_transcode.dll","oneds.dll","shfolder.dll","in_capture.dll","ShellCommonCommonProxyStub.dll","vcruntime140.dll","System.dll","riched20.dll","in_pxtone.dll","ml_bookmarks.dll","Windows.Media.Playback.MediaPlayer.dll","dhcpcsvc.dll","uxtheme.dll","gen_hotkeys.dll","gen_classic.dll","Windows.UI.dll","fwpolicyiomgr.dll","in_ncsf.dll","twinapi.appcore.dll","mdmregistration.dll","fltLib.dll","cryptsp.dll","domain_actions.dll","cryptbase.dll","in_msx.dll","dhcpcsvc6.dll","Windows.StateRepositoryCore.dll","in_mp4.dll","in_snsf.dll","ml_radio.dll","comctl32.dll","setupapi.dll","schannel.dll","imagehlp.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","usermgrcli.dll","in_mpc.dll","in_vermas.dll","gen_timerestore.dll","gen_yule.dll","Windows.Media.Playback.ProxyStub.dll","dcomp.dll","gdi32.dll","dnsapi.dll","Windows.FileExplorer.Common.dll","in_wave.dll","gen_undo.dll","wintrust.dll","win32u.dll","rasadhlp.dll","twinapi.dll","ExplorerFrame.dll","secur32.dll","umpdc.dll","vcruntime140_1.dll","netutils.dll","in_audio.dll","ucrtbase.dll","wacup_update.dll","sxs.dll","TaskFlowDataEngine.dll","netapi32.dll","coloradapterclient.dll","profapi.dll","npmproxy.dll","vk_swiftshader.dll","ffmpeg.dll","oleacc.dll","user32.dll","VxSSL64.dll","ntmarta.dll","mswsock.dll","in_org.dll","Windows.Media.MediaControl.dll","nsDialogs.dll","ncryptsslp.dll","tbs.dll","sppc.dll","propsys.dll","d2d1.dll","ntshrui.dll","gpapi.dll","dmcmnutils.dll","Windows.Security.Authentication.Web.Core.dll","ntdll.dll","tiptsf.dll","w7tbp.dll","in_magnumopus.dll","Windows.Media.Devices.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","wacup_helper.dll","winsta.dll","onnxruntime.dll","rsaenh.dll","WindowManagementAPI.dll","shlwapi.dll","gen_classicart.dll","powrprof.dll","msvcp110_win.dll","KBDUS.DLL","WindowsCodecs.dll","kernel32.dll","msvcrt.dll","srvcli.dll","in_shnobi.dll","gen_replaygain.dll","wkscli.dll","webauthn.dll","imm32.dll","dxgi.dll","cfgmgr32.dll","TextInputFramework.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","vaultcli.dll","msctf.dll","WinTypes.dll","gen_waveseek.dll","cdp.dll","Windows.Web.dll","libGLESv2.dll","nsi.dll","fwbase.dll","in_cdda.dll","in_vgmstream.dll","oleaut32.dll","apphelp.dll","msvcp140_atomic_wait.dll","ntasn1.dll","d3d11.dll","MicrosoftAccountWAMExtension.dll","bcryptprimitives.dll","in_tta.dll","wtsapi32.dll","directmanipulation.dll","in_psf.dll","in_mod.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Plugins/in_2sf.dll","sha256":"92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_win10shell.dll","sha256":"44c2043b90af0b5c57189a474102530a31b098e40ab2ca5fafa56ac57e5575df","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_waveseek.dll","sha256":"e2ffeac820b5da39448f2d2bc7a1c14db2c268b0316d482c3573be67afe3ac84","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_vorbis.dll","sha256":"c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_thinger.dll","sha256":"51be2a6cb12211f359fa8b4c375a423cf72378b2bbf6737e29352bdfa6bb234d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/ml_radio.dll","sha256":"a9e40c756c9411f079764debb22c8dac7b4c72c498c0d157e2936307f7be2cad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_msx.dll","sha256":"f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_later.dll","sha256":"868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_url.dll","sha256":"92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa","sha256":"4abd45f92ba9c89c95ae0fdc85416660d17022ba6fcbed93fa9efb75f78bb0aa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/out_notsoyasapi.dll","sha256":"613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_psf.dll","sha256":"c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51","sha256":"2184ee19f2f89cfc97920f45ee8175d1f64facd42a9b22aaf80f25e52a134a51","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_yule.dll","sha256":"9abdbcc365706c34a59691435c3b5e3f09e1c2cef154e4ce54f0ccf1bd58dd2c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/out_neo.dll","sha256":"0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libsndfile.dll","sha256":"5f016267aec3bb25bae0e00562c8e53d3ff732769f0d8094936e3338686e13e1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"soxr.dll","sha256":"33b740d0ed92d0d68ae7bfbda0963d16acb6df5c7f7ebf5d4749a453bcab2a55","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_notyansf.dll","sha256":"e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Microsoft.VC143.CRT/api-ms-win-crt-convert-l1-1-0.dll","sha256":"7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_ncsf.dll","sha256":"3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_usf2.dll","sha256":"5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_text.dll","sha256":"7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libopus.dll","sha256":"abdb12bcf970c0e8ad2a34d75db67b7ae64a48d6b1378af464edf5952ed49629","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_org.dll","sha256":"18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_cdda.dll","sha256":"833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193","sha256":"f30d31a7c27d0e458473dc8692d73c2088adda3339f59d0f7cbaa32774ae8193","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_what.dll","sha256":"8050e9ac428ec2418ae0d5256f74d500fa1f969d877bf5cb4111258fdd2c0fa7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"msvcp140.dll","sha256":"0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/in_capture.dll","sha256":"788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_sidious.dll","sha256":"6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lzma.dll","sha256":"544e919612b6856256763ef38b64661c0aa7f2dd95e3316c2651f7953d507b00","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/ml_bookmarks.dll","sha256":"7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"vcruntime140.dll","sha256":"d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/gen_jumpex.dll","sha256":"e7694445baf099c95b12c2fde771c1948fb5616985f847505b651d77a45579c6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_vgmstream.dll","sha256":"a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"msvcp140_atomic_wait.dll","sha256":"640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/gen_timerestore.dll","sha256":"b713f6a2bb6098b1d4e2fc37b6dadf98dacf181711320628d88ec5b7a177c182","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libvorbis.dll","sha256":"f4594878d0fde564d3a519ea1ac2c6c352cad4a1f26c80142c6278e6d4b76bf6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_tta.dll","sha256":"509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_sc68k.dll","sha256":"35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_vermas.dll","sha256":"5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_flac.dll","sha256":"24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_hotkeys.dll","sha256":"e390ea667e89ae6d1567dc263e568837c763093c0c2b5ca8344d0488ee06248d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_classicart.dll","sha256":"2a1e8ba097b8e41394a4434e9df579b15716e6b717ca487f1c9fc7d328da4d9e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_mod.dll","sha256":"1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$_22_/vis_milk2.dll","sha256":"e093f4d617dd64754d899370efaaeb3f3a77463c02f90d4aa688906118f25ca3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/enc_tta.dll","sha256":"d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"wacup_res.dll","sha256":"4b6bec03b6150595cc5fc695e0f2f7fac03c5f0f6c2f0b92f8c1a9d1b85961ce","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"$$PLUGINSDIR/System.dll","sha256":"d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Microsoft.VC143.CRT/api-ms-win-crt-private-l1-1-0.dll","sha256":"5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_mpc.dll","sha256":"33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libmp4v2.dll","sha256":"c582e91a6ea31bc9f0479d3a85dfcb3b80c389011942dd878087fadb9857565a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_replaygain.dll","sha256":"bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/enc_fdkaac.dll","sha256":"37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"wacup.exe","sha256":"cc9cc6b835a61536872d0c3cdb07b1878cc5ed5dccaed0178503ded342e40c15","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"vcruntime140_threads.dll","sha256":"219915cf20822f34d5e7c1fdd4e21ae7f3396881096c51036225fb8f84b47afa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/gen_transcode.dll","sha256":"b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libwavpack.dll","sha256":"f5885ff686cdf5c812bc32854089509f3bab5306ec60fcce761fb967ba522d5f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1","sha256":"e70f81229571b6069062e587957f01062f61fa08aaa246e0df828bcebc3d11e1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/ml_exporter.dll","sha256":"ed51177af8c9d7af6def523e4dd812df038dfaa7ff575ef526d8d06d11867df8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_play_remove.dll","sha256":"9342b3250c695d1a0a47c8fa5d9b212c9072420f6238ecbd9f316753477f8df9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_webmkv.dll","sha256":"855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libfaad2.dll","sha256":"085ba6705e6420e44518d437aa45b8304319bd9f433e601f7e373a62a98d4d24","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"$$_22_/vis_classic.dll","sha256":"f7a62aa0ff3a82b6761096dfaf08361d252b61f0fb0ef2d1b0ad3a4f4275b724","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_lyrics.dll","sha256":"72c253ed45ca7258fb867bf43f765c8db067534d110ff35b9dda7b42c8fcea1b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/ml_ll.dll","sha256":"f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_mp4.dll","sha256":"97efcd587b02cfd00c1f0c03f4f8b9878ac97207b54f07168dd113de41b57123","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/ml_history.dll","sha256":"03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_undo.dll","sha256":"25046cd6057ba1ef9ef01b69f9e919ea1159fde9e951ccad13a8d27ca19d32ec","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_gsf.dll","sha256":"dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e","sha256":"d611db48b602846f7670215b3efb474661caf357c50c53f4a9ce174f8004301e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_bigclock.dll","sha256":"80f55a1a1858dad8d49caba8e48159ad522056e1fe84ae2788e16fcdcf3eaeb6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/lame_enc.dll","sha256":"acd8a446eebb120af0b63dcfaa6567d87c38ee65103a7d208b8161c05a5170ba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2","sha256":"276aab28451461e08742f0edcab4bbe50fbdc768ac186d24b93014b061e5bfa2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_snsf.dll","sha256":"4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_hively.dll","sha256":"fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/out_notsodirect.dll","sha256":"3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_win7shell.dll","sha256":"7f39c2e7557d3063cae12f7ae9171cbf737c9d95fa12a98974081c46fcbfcaba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"unrar.dll","sha256":"290ea771ea62282e55b40e67bd6779d7a15aa9d9a7ead0a07acb6bf2b30cb928","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/in_pxtone.dll","sha256":"4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529","sha256":"d17c3eeed32956c67ef9eb389582829c045ccf44057131af133cd95e549ad529","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"vcruntime140_1.dll","sha256":"1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/ml_playlists.dll","sha256":"33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Microsoft.VC143.CRT/api-ms-win-crt-runtime-l1-1-0.dll","sha256":"f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"tag2.dll","sha256":"f026cf55abfd3f108432e24d93da11cb4d9bcde5fe1cb1f1ee82601a415522ba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"$$_22_/vis_geiss.dll","sha256":"87821dc11890cf86b0c467bc5ace7910cfb8fd4954e4b312ff05350dd4c38f9f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"nde.dll","sha256":"b0b426b68bb0913537dfe9180ac3960339f7aa03fa9c531dca7534b0f90bed69","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Microsoft.VC143.CRT/api-ms-win-crt-math-l1-1-0.dll","sha256":"2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_magnumopus.dll","sha256":"4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_wv.dll","sha256":"0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libflac.dll","sha256":"84ee4137a311fca29c1fafa618c0e17e876b02d7a78763919ea78b70602e622d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/dsp_wc.dll","sha256":"dedec69862470eeee6d310a0c58cf1ee63a0a6b5f15e385d1f24bd3fee28c494","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_exclude.dll","sha256":"9cc00535722f7d0239d520659ec380e525a27124f6dd67a428d5dfd31a85099f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_ape.dll","sha256":"09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/out_notsoasio.dll","sha256":"e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/ml_podcast.dll","sha256":"28e673356267d156b1524169b6d954690b9e63ca3824fa28edcc3609214ed9dc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_addanotherplug.dll","sha256":"8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_qsf.dll","sha256":"c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Microsoft.VC143.CRT/ucrtbase.dll","sha256":"dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/gen_wc.dll","sha256":"8ef006c27c923ae061eda5bd491fdc6aeb7a111f316ee916023f9cae1f96df5a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Plugins/in_zip.dll","sha256":"d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"mpg123.dll","sha256":"f094226e4bbc5b101ee6ae183232bbab651978a2e92a5acd84fd3e0f40cb6da2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/gen_classic.dll","sha256":"c6da94553fbf27256a2f144eae834b394db37e214834f1ac5afca8d1c6bb1c44","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"zlib.dll","sha256":"17d6ef28c1f6ac2fead5f2ff2a2e5ac204a4854a429a543032a6407a0d9ed2ef","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Plugins/in_wave.dll","sha256":"57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ucrtbase.dll","sha256":"dbdc8cd8f1047cc477e69a02f78ad0ed44cb62d437b6734870e3401386bea1ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"wacup_helper.dll","sha256":"b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_fdkaac.dll","sha256":"37fec8cf0ec7c6bae058f7d9e7348a822960bdc3f9081d95d955fe399091dbf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_2sf.dll","sha256":"92c6af31daa3401f0837a04bc8d33f092b59064ff30423c3bdcd22ad9d0f3976","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_addanotherplug.dll","sha256":"8013b0acb4777b00f9e34fe8e68ff1dfb476a5f43f7b352400177942f6c099bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_gsf.dll","sha256":"dd47da8e9387182ca9f6117b31b7b9f7bf785c278d7a8b80ddafe97b3acc4827","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_mod.dll","sha256":"1c88e470482d6efeb9190e57c490dfcac53a2594b8c92fcaa34611ffa548f7be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_org.dll","sha256":"18db4851c5afcd3a4b653732e3a72cf69def20a24a980ea9b0a477172e914827","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_psf.dll","sha256":"c8d02408f3606760855c8cb5544318c47135d293fe0e6ab43768b87e9c87376f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_sc68k.dll","sha256":"35e12f815fe773ab87109a74024106368da319126c6d0e9552a434a3e5c220b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_snsf.dll","sha256":"4c43c9f99bdbe599277640731682edb207431bb4f3327da75247bc769cdfa534","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_usf2.dll","sha256":"5f5958eb2207481bc0019db492fdd3939d7fd91573bad781b914a5d786460cb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_vermas.dll","sha256":"5ee9da715ccb27e3bc87bd11f0ef804416a4e59fa8b6425024176b871caa83a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_vgmstream.dll","sha256":"a21a5d9859a1d2855147d622a0f9335563d38449f7216e5d64b6c6a447631562","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"ml_ll.dll","sha256":"f6938a6ca1b3d54ae8dad6f5aa0bdd7420a0b06442e516e9477de30511f996d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"out_neo.dll","sha256":"0f5ef4cf46f465a48531bf12cfc6737ce1b633925d09b0e7f3ffa1bc5a65b7f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"libcurl.dll","sha256":"142939fdd15ffdb658cb27926c1ab99b573df22330eecd81b31b531a808a0ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"2a303ab60c40124efc793b7facdccf581524d271f8c48f7cff84794ae70a09e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-console-l1-2-0.dll","sha256":"0e822bd2062f234a2272846e0a52f7e30d60631ca8aed010a21a636319cefc6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"0bc5624723725ed188ac781b9b9e8faef90921bfb3cb7efb2dce6bf9aead00b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"c1b4d9fbdb818ad4d3efd1c69ca6b94634dec0f413736a8d14c7f378df82fcb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"5c68f07fd5b26cbdefb819be95e9965a6e5086d71241e703cb92976089724a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-fibers-l1-1-0.dll","sha256":"729fd64f661d8b34321e57bed297201818cc5f5984b453900296d179ce0dcfb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-fibers-l1-1-1.dll","sha256":"cb715cc1771a4a1e9f682666d9fdf30085a656386cb2df2cbadb62bad3346e7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"52ac9cf92558bca053ae8ec95c87ec2e7b39d3ca8e013676060a2f3b6adb4930","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"8746d8fd6ada8cbe31803644f785461a58d6b89812f40325cd493c155e57ad97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"e0c03aa9d6c8c9010f8fce517511524401711504855592b0f0703c137a915a5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"506f80f779dd95419a8fbda3cabd770614046b64b1be0455b62558664db85f4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"87f5578925154ec2d2b52b189f3cf27caf1d3abc29f4b5fbe4bbfee746c2c3eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"cdca66d6d7d936dc881230868703094abbbeecd946268f7f52af729472619b4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-kernel32-legacy-l1-1-1.dll","sha256":"1c9247245e63dd20b406de29520f77c98967a0a3a96c940ea2ebdd6eee9280bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"fd4b3472c452730b250f1ad7284af45f758bc8370c0687a6020054072c551cc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"edcaf1fbb669fd8e5aa88b0976cb59a0a2e6c14f52947e09beb31e4b6ccad543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"14c37023ea67ec68d121d13866e1af5657af3a58665a9308f6b372652b349344","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"befc9a19c804bc06eb2d03793164e5e25a78d3a2d4886054da02f9c5dcd43d54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"fe1ead43adb4ba2d3a5badf9372d35a49fa94affa7ea019c46d399c80e912713","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"e0cc30956fa5b83cf2818aa66391297817a3fa20b7a0a93aeb3c1e2226550ffb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"39a3771040889cd5687886a47673e463fc1c11f0912db3037be6a723eea24e05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"a65fc761c411044ffe4b74262bc772e93dff388199d76197ead3d83b48bfd600","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"3af24743b2706303a9f32cc31c4991d88280757eaa61060bfdf7bea751cc6273","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"6d41bd2d5380b6ca0eedea7a07191562bbfe2c06ca1868c82dd67a1934733192","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"967fe671582dca8bb9ed3faf7b6848f9407e2bb4d43e3d6ddb16fd32590395e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"ef1724edf3763340b6eb3b1188a62291bdb7b71156d6775e8326daf3733e7f5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"c8596ad4d200c35870975dffef0e263ead11d2f888481a40a3fce7990cbc3f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-sysinfo-l1-2-0.dll","sha256":"bdd27b72c25ada8bd8fdf5a732589cbe4d7c2b6e70cd04a5df8943acc8c1321d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"32af8ca41c4cfce9a7ffac402ebdced89d3328d0072bcc371301663e478b7c9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"9c46194218f43c3eaaaa46a1fdd822f81b331ad94bf531287917cada4f9b09d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"00cbabc8e73828b65f10d452e1856e5eb03147c89c16812e815c5e7d5b968de9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"7255488854eae6c958e46d2ed616733241d368200e75764ba31fd6ee943a4f9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"488cbafbee826ad9d32d86508b53b067504cae31ec1ebf271c402ccd34a9b9fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"d161558c87ff680b148baaa8eb5b99b6641675967c9a4a53a330067321c50394","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"b17ff71e85d21247dfe1a00d9507cd65f3ad8d2c0ee0e6ded90954e96871a22d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"30fd4f5574658d34eeaacb5201ece6c9810ce1fa4fc76b6cbee7f0c83cb390e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"2dee8b875b3e8d50da9b6b1edaae56938505b64430861d8665e8ae0e95dfac48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"f7e0c554af1085854625caecf81aa08175f55e2d5224b3b5d034a6f3495edf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"5d8948a1d58d4d94b0f12390181c61e7047026b2fca8850b6237dd3e9b7a59cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"091ed228d2928e22e5e4cc8674207692544093f2ff81f0435f3b94669b44dce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"f8b7cd724e5644b586fe1ef70f8f29173ca28f834f4f62e5d78bd4b85c3b149b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"55a61b280575b4ebdd9386d74c949cf23e5fffeeb984aca45801a917651c778e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"ec7d880ea488601e416054e6a0845a3739f6db6dae0c55267d0a48830d27b137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"b7f379a14ca42e702f646755cdb6356e68b47ca18cebc783cb9e0a7160470a48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"bc1abfacae076996912cd20250f5829ab646f79f0303ce9f3c90cb260e61b310","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"System.dll","sha256":"d4f092a13204f8f98be183d1ee25a0c53b4b3b98073f0a586044ccebac3be2ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"nsDialogs.dll","sha256":"d3affe9879840d2dcc318809c3bff6e64a276b2d8ec5fcf8deea230c43c55bac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"w7tbp.dll","sha256":"b3534dbc5f84524d8bcb2e64a083a579c4f62eb30bf7ce16b417e2e177a04bbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_tta.dll","sha256":"d466e1e37a2ce1aaf66fbbd9fbfa19c62d734594eb0f655308e03ca2066007d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_tta.dll","sha256":"509e962c21d408e59eb293b5c388572d06a77473b20afcbba4729fd5e159a896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"wacup_update.dll","sha256":"b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"winamp.dll","sha256":"b0aab8938649d2868b0b80a89fcb21a92719f56a1dc3d5af499f883405674a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"gen_ml.ini","sha256":"26b2087aaa7630a5faa4a60460f7310829990aa97bc090c13f05cdc180e71a32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met1634.vmd","sha256":"2a0e91c2370abf93781dabbbfdb1d7bd459f4c212710006172ab8581db8b3dec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met1644.vmd","sha256":"d5265a2716c09f0875aed7f2a525cee877110bd9d9c510f94365f6b65ab28511","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met2606.vmd","sha256":"481929a6a64704835eb84e8929941ae6f22545c682d21e41a3adb6a14c577074","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met2616.vmd","sha256":"349017bdf3c8a522cc9a9085b48639c8b37a17e829b3199e8b766455b8ff2879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met35D8.vmd","sha256":"46500d39474293eb3b830eae2cf42bf2a049544e84dfe1458ce155153adf7b89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met35E8.vmd","sha256":"e25d2c314cc152c6b550cd7aa62303fe201bd089ed6d87e35d20b0717d79c0b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met662.vmd","sha256":"1aefa74e576383ac2ba641a467731116d57f822e17820565f96c4479d516d5ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"met672.vmd","sha256":"1721e50bfd45f4fb4134b07f344b859d4a89626b88552c15a45b6514810aef21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"metB65F.vmd","sha256":"adca25222a9dd204b70b75739f3fb05206ac3bc8a96a675fb386533747e25b62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"patreons.rtf","sha256":"762de3879f1c6ada1cb36bbc78766d45e01150a2cf0edbc9abf9f7ebfdaf08eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"plugin_descriptions.ini","sha256":"aa98b84691dcfa8df31028e855dae3ef478bdd913b1584f5d7fa2114d5aae3b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"profile.ini","sha256":"90e91fdf1cfc6eee3ee88bc497a24ede6847351350c63f92ca7909c8270ea64d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"winamp.ini","sha256":"e307486c9b8dcaafdefec148e6890f7ebcc2fe1a5fedf18f670cc0c3056bc9e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"winamp.q1","sha256":"58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Microsoft.VC143.CRT.manifest","sha256":"c77597244698cfbc79c12a2aaf66d44c11c19ec67669b208ab3a38b5a9be2c2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"discid.dll","sha256":"f8b6eb3e0ac2af579d315ea46d03eb47719a252ff78c59c3d34bfd39b593b71a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"dsp_centercut.dll","sha256":"246bd5531ff2507702456438d4654c269618d9d5225641c241df47121017f8dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_flac.dll","sha256":"efe4243ef67767b0b330ce5cecc5915f1d525672306f1ed1ee6c253d685a94eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_mp3.dll","sha256":"0156d660fd266775673b930c7decebb9874e102345d226ca85ec64f15bc3d881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_opus.dll","sha256":"b2b4fcb39e4ed697febabf08cbc849605ef0d0567ccabaabb0fac53ee568d955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_vorbis.dll","sha256":"d86b012db5c5b714575ac5cd4a363ad4aca2426323e1e645c1f467ad9c9dbc25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"enc_wav.dll","sha256":"f53eeb91b39c9bd6549305d9123e2075414a84c25416a0e50c18fbee548309c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"gen_replaygain.dll","sha256":"bd58414a1eed577993b5d58105091f99091b39deea788bc169a9d76e147f1770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"gen_transcode.dll","sha256":"b75d121a32ab5504b93c4f1240c37d2fe1148da30ce4e5eca3ba5676f30ce773","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_ape.dll","sha256":"09ef0ee6cef793a3e587c2c6d7169ea8a0f226a20d2dde59934c758f23a03781","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_audio.dll","sha256":"4b1e45c1ee0350bb30bad5f5df6dabab10201c7ac1252cd1e0f62861158eea93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_capture.dll","sha256":"788adf800dccab06a96a393c62eb323407f998d120dff53684b343b91f1c9458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_cdda.dll","sha256":"833ce79e500046bf8a59f57328905257e660e0676dcdecad990ecd21ed5e2028","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_dsd.dll","sha256":"e0571b9499ffcbaa4fce8530208d513ced9cb4479ae8caebaa32475891c81d50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_flac.dll","sha256":"24793be2f16c836b9b6c2d270a2614af315b4bcebfe2467bcf2214d5f286a4e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_hively.dll","sha256":"fbaf3c78ff069d48aadab20a3da882c721fff13ed3653cab266237ec09c2b535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_later.dll","sha256":"868c27ece5fec759816c731594a882b44c6ca9e88bf21ac6025c3c0d19a9f1d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_magnumopus.dll","sha256":"4c40ff0d8690e4a230bfad07b1dd4fa7bbe8ff9e20b13ce0d6337590915276cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_mpc.dll","sha256":"33a306a5bf27ce6a754d2a35e2bca3f4e6c86d67d3e128c56473da1e0ed1979b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_msx.dll","sha256":"f5c72566ac99e7c47a5859515a21809bea0317291076e7d4d9652b97d9c39b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_ncsf.dll","sha256":"3610b91c400f54cd0e8b25cdd67dbef771f1583339fd77ba7c0659e182032c52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_notyansf.dll","sha256":"e54fd534830ebe56262831e84ec7a9a051d299e1ce84d0f2391ddb3b6531851a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_pxtone.dll","sha256":"4852e573f808220e1fb4827ad0c21adb09cf6993a1823a00bd9b0ffda78dd3d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_qsf.dll","sha256":"c20e896df0f00d31681a25efbb773488bfe8ccf3cfc98c9a5b0a52f6215758e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_shnobi.dll","sha256":"14841d2123bf26df2d2d61b60f503840efe5936928670ffef1816eb30928367c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_sidious.dll","sha256":"6ac802d9dde01586a43f4abb041a8b169256f5e1dc937c7dcbc6037bc24f0475","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_text.dll","sha256":"7ca85616fcd74d1f7f9efd304a703102b17131e09f557b5ad9be6476f37991ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_url.dll","sha256":"92faabff76527db2b96f58404cad379a8eaba6f21c840b6c8e790a49e16904f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_vorbis.dll","sha256":"c87e1e41dd0d1b9e4b51c6f41bcc3e3531a06fc236aae2bb26c6dcd3ca46f1c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_wave.dll","sha256":"57dcc1263d4374d68cec80e98d27edcff48c2fd69883ddcd5184e1bc89a17b11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_webmkv.dll","sha256":"855db96b9c88d65022f927fff61802de2a945c9eb0eb704932d191408003e433","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_wv.dll","sha256":"0ee5f81a520b0dba230e74dcfa2c2649ab5227683ee16728a30fd0e780da9a43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"in_zip.dll","sha256":"d37d02ab128766025ceafad0b2f209823f467fda4f0da479230dbf5fb61c238b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"ml_bookmarks.dll","sha256":"7c40a762fef58211c4dd4ac8a6a5e992b4f3d00ecde465783f94bed3ce6d081b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"ml_history.dll","sha256":"03cca700d78614b70aa2bdd6a322edd26f5a2428379254d2a38caff9bd5cbc8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"ml_playlists.dll","sha256":"33826e4a9eed02222b7085a895f6b8c9c297ab47941a848bdc9bcf7ba90c7c9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"out_notsoasio.dll","sha256":"e7c4d21a9418fc04c5a0976e2dd6375924b241ead49d77fd7e2e422200b6573f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"out_notsodirect.dll","sha256":"3100981163d1cff115900c5966e26651189e947286ae2ee56a7545031ff1240d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"out_notsowavey.dll","sha256":"b4c87784e4abbfd3dc284b11a1e8a7995bd395e8ffa500bd65650826f2e73de1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"out_notsoyasapi.dll","sha256":"613f3b435603b421b2db7ef14e8df659062838edc619d8bfe3c2597797e1588a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%TEMP%\\nscA1BF.tmp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%TEMP%\\nssA21E.tmp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\System.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\modern-header.bmp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\wacup_helper.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\Microsoft.VC143.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-console-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-multibyte-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\Microsoft.VC143.CRT\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\install.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\install.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%LOCALAPPDATA%\\WACUP\\Setup_x64\\w7tbp.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%TEMP%\\nsxADC2.tmp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\WACUP_Tools\\koopa.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\paths.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\winamp.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\Microsoft.VC143.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-console-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-fibers-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-kernel32-legacy-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-sysinfo-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-multibyte-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\Microsoft.VC143.CRT\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\msvcp140_atomic_wait.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\vcruntime140_threads.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\wacup_update.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\winamp.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\libcurl.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\lzma.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\nde.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\zlib.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\mpg123.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%PROGRAMFILES%\\WACUP\\libfaad2.dll","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\Plugins\\artcache","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\Plugins\\ml\\playlists","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\Plugins","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\wacup.test.7508","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\Plugins\\reporter.ini","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZI0SF75WVREUX6FZ7ISD.temp","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"%APPDATA%\\WACUP\\WACUP_Tools","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\crashpad_2744_NXEWZDBNQEYCAGVO","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.3460.15077837463428857757","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.3460.15976801379037606243","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.3460.10454608286601350599","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.2994154934630669988","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.17437319571571983931","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.14949892768499063774","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.15637873072776362013","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.13937546167828030029","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.77201995023979927","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.2744.5596.5094352537009051346","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"path":"pipe\\LOCAL\\mojo.1912.2360.6257924693383650035","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:2044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:2044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Winamp - C:\\Program Files\\WACUP\\Plugins\\gen_hotkeys.dll ^&*#@","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:7508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Winamp - C:\\Program Files\\WACUP\\Plugins\\gen_hotkeys.dll ^&*#@","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:7508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:7508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:7508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\BaseNamedObjects\\WACUP@C:/Program Files/WACUP/Winamp.dll-0x19956","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:2744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:2744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:8252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:8252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"Local\\SM0:3052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:3052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:3040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:8120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:3412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]},{"name":"SM0:2640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adaa129a0e9569451057e3d"}]}]}},"report_ids":{"sandbox_job_ids":["6adaa129a0e9569451057e3d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 63374B76AAB3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 63374B76AAB3…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/63374B76AAB30E1DDC2A07183D19DA8BE69887ACF894BA16E3697E89A0C160CB"}],["$","meta","4",{"property":"og:title","content":"Sample 63374B76AAB3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 63374B76AAB3…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/63374B76AAB30E1DDC2A07183D19DA8BE69887ACF894BA16E3697E89A0C160CB"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 63374B76AAB3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 63374B76AAB3…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L65","11",{}]]