23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T526,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")25:T5c0,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "TestDLL.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsDialogs.dll") file/memory contains long string with (Indicator: "postmessage"; File: "ButtonEvent.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "SkinBtn.dll") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")26:T53a,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005652)27:T814,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000002000000001000100f88f4f0050904f00b1ca547750904f0000000000280000000000000000004e00f24d5e0ce0f11900187a5400d8f31900b0e85777568f267bfeffffff44f319003170367503100000000000000000000000100000000000000000000001000000e0cc36757cf31900f24d5e0c (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007b500000000000095054770300000000000010065154770000000097865400988654000000000000004e0000000000a8fa1900a6eb54770000000000000000000000000000001000000000f0fa1900e638367500004e000000000098865400d14f55160000001098865400000000009886540000000000c4fa1900bcfa1900 (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000075e0000005e00426e827400000000feffffffa8544e0000000000000000008cf219000200000010000000c0015e00000000000200000000005e00010000000800000000004e00a40c5e00e2f47f74a00c5e0098f21900feba54770800000000000000080000000ed6f2f5dcf41900da91ea7300004e000800000001000000 (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c006e007300770044003100430042002e0074006d0070005c00540065007300740044004c004c002e0064006c006c002e0032002e0043006f006e0066006900670000000000 (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005652)28:T422,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") file/memory contains long string with (Indicator: "FindWindow"; File: "ButtonEvent.dll") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")29:T4eb,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %TEMP%\nswD1CB.tmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %TEMP%\nswD1CB.tmp\Slides (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "CreateDirectoryA" with parameter %TEMP%\nswD1CB.tmp\Slides\.svn (UID: 00000000-00005652)2a:T628,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\FindProcDLL.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\SkinBtn.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter RichEd20 (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\ButtonEvent.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\nsDialogs.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\System.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\TestDLLENU.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\TestDLLLOC.dll (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "LoadLibrary" with a parameter %TEMP%\nswD1CB.tmp\TestDLL.dll (UID: 00000000-00005652)2b:T19f9,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter FindProc (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter GetModuleBaseNameA (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter Init (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter Set (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter AddEventHandler (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter Create (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CreateControl (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter LoadImage (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter LoadImageA (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter onClick (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EngMsgSw (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005652)2c:Tf78c,Found reference to API (Indicator: "MulDiv"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DeleteFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FindNextFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FindClose"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetFilePointer"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ReadFile"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "WriteFile"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FreeLibrary"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetProcAddress"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GlobalFree"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "lstrcmpA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CloseHandle"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetFileTime"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CompareFileTime"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SearchPathA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "MoveFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetLastError"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "Sleep"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetTickCount"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetFileSize"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CopyFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ExitProcess"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetTempPathA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetErrorMode"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "lstrcpynA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GlobalLock"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateThread"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateProcessA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateFileA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "lstrlenA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "lstrcatA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetVersion"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DrawTextA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FillRect"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetClientRect"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "BeginPaint"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SendMessageA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "InvalidateRect"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "EnableWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetDC"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LoadImageA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "IsWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "FindWindowExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "wsprintfA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ShowWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetTimer"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DestroyWindow"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CharNextA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegisterClassA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ScreenToClient"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetWindowRect"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetClassLongA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetWindowPos"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetSysColor"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetCursor"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LoadCursorA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CloseClipboard"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SetClipboardData"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "OpenClipboard"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "AppendMenuA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CharPrevA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "PeekMessageA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SelectObject"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DeleteObject"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegCloseKey"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "OleUninitialize"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "OleInitialize"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "MoveFileExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API (Indicator: "LoadImage"; Source: "00000000-00005652.00000003.191120.004E0000.00000004.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalAddAtomW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ConvertDefaultLocale"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalHandle"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GlobalFlags"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ModifyMenuW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "PathFindExtensionW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "PathFindFileNameW"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")2d:T609,"Software\Microsoft\Windows\CurrentVersion" in Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp 00000000-00005652.00000001.181772.004E0000.00000004.mdmp 00000000-00005652.00000002.183690.004E0000.00000004.mdmp 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "SoftWare\" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp 00000000-00005652.00000001.181772.004E0000.00000004.mdmp 00000000-00005652.00000002.183690.004E0000.00000004.mdmp 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskManager" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp 00000000-00005652.00000001.181772.004E0000.00000004.mdmp 00000000-00005652.00000002.183690.004E0000.00000004.mdmp 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005652.00000001.181772.00407000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp2e:T40e,Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5652:168:WilStaging_02" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5652:168:WilStaging_02" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5652:64:WilError_03" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5652:64:WilError_03" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "Local\SM0:5652:168:WilStaging_02" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "SM0:5652:168:WilStaging_02" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "SM0:5652:64:WilError_03" Process General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe created mutex with name "Local\SM0:5652:64:WilError_03"2f:T778,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp "SoftWare\" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskManager" in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005652.00000001.181772.00407000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005652.00000001.181772.004E0000.00000004.mdmp "SoftWare\" in Source: 00000000-00005652.00000001.181772.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskManager" in Source: 00000000-00005652.00000001.181772.004E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005652.00000002.183690.004E0000.00000004.mdmp "SoftWare\" in Source: 00000000-00005652.00000002.183690.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskManager" in Source: 00000000-00005652.00000002.183690.004E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "SoftWare\" in Source: 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DiskManager" in Source: 00000000-00005652.00000003.191120.004E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp "Software\" in Source: 00000000-00005652.00000003.191120.007C3000.00000002.mdmp30:T8e4,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 746c0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a00000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "SHFOLDER" at base 746b0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "KERNEL32.DLL" at base 75b30000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\FINDPROCDLL.DLL" at base 10000000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "PSAPI.DLL" at base 75210000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\SKINBTN.DLL" at base 10000000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "RICHED20" at base 73e40000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\BUTTONEVENT.DLL" at base 73de0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "RPCRT4.DLL" at base 75740000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\NSDIALOGS.DLL" at base 25b0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\SYSTEM.DLL" at base 25c0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 772d0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "COMCTL32" at base 74f80000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76f40000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76610000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76610000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 77250000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 761a0000 "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" loaded module "%TEMP%\NSWD1CB.TMP\TESTDLL.DLL" at base 7a000031:T4c5,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" was detected as "Microsoft Linker" and name: "Linker" "TestDLL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "TestDLL.dll" was detected as "Microsoft Linker" and name: "Linker" "FindProcDLL.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "FindProcDLL.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "nsDialogs.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsDialogs.dll" was detected as "Microsoft Linker" and name: "Linker" "ButtonEvent.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ButtonEvent.dll" was detected as "Microsoft Linker" and name: "Linker" "SkinBtn.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SkinBtn.dll" was detected as "Microsoft Linker" and name: "Linker"32:T658,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\FindProcDLL.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\button1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\SkinBtn.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\button2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header3.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header1_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header2_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header3_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Progress.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\ProgressBar.bmp"33:T242c,"TestDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nswD1CB.tmp\TestDLL.dll]- [targetUID: 00000000-00005652] "FindProcDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nswD1CB.tmp\FindProcDLL.dll]- [targetUID: 00000000-00005652] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nswD1CB.tmp\System.dll]- [targetUID: 00000000-00005652] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nswD1CB.tmp\nsDialogs.dll]- [targetUID: 00000000-00005652] "ButtonEvent.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nswD1CB.tmp\ButtonEvent.dll]- [targetUID: 00000000-00005652] "SkinBtn.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nswD1CB.tmp\SkinBtn.dll]- [targetUID: 00000000-00005652] "un1.bmp" has type "PC bitmap Windows 3.x format 536 x 357 x 24 image size 574058 resolution 2834 x 2834 px/m cbSize 574112 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\un1.bmp]- [targetUID: 00000000-00005652] "finish.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\finish.bmp]- [targetUID: 00000000-00005652] "finish_en.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\finish_en.bmp]- [targetUID: 00000000-00005652] "welcome.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\welcome.bmp]- [targetUID: 00000000-00005652] "lincese.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527424 resolution 2834 x 2834 px/m cbSize 527478 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\lincese.bmp]- [targetUID: 00000000-00005652] "Thumbs.db" has type "Composite Document File V2 Document Cannot read section info"- Location: [%TEMP%\nswD1CB.tmp\Slides\Thumbs.db]- [targetUID: 00000000-00005652] "ProgressBar.bmp" has type "PC bitmap Windows 3.x format 535 x 42 x 24 image size 67538 resolution 2834 x 2834 px/m cbSize 67592 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\ProgressBar.bmp]- [targetUID: 00000000-00005652] "bottom.bmp" has type "PC bitmap Windows 3.x format 536 x 42 x 24 image size 67538 resolution 2834 x 2834 px/m cbSize 67592 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\bottom.bmp]- [targetUID: 00000000-00005652] "Slide 01.jpg.svn-base" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:11:13 10:54:53] baseline precision 8 535x328 components 3"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\text-base\Slide 01.jpg.svn-base]- [targetUID: 00000000-00005652] "Slide 02.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:09:27 15:31:49] baseline precision 8 535x328 components 3"- Location: [%TEMP%\nswD1CB.tmp\Slides\Slide 02.jpg]- [targetUID: 00000000-00005652] "Header3_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header3_en.bmp]- [targetUID: 00000000-00005652] "Header1.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header1.bmp]- [targetUID: 00000000-00005652] "unHeader.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\unHeader.bmp]- [targetUID: 00000000-00005652] "Header2.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header2.bmp]- [targetUID: 00000000-00005652] "Header1_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header1_en.bmp]- [targetUID: 00000000-00005652] "Header2_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header2_en.bmp]- [targetUID: 00000000-00005652] "Header3.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Header3.bmp]- [targetUID: 00000000-00005652] "Progress.bmp" has type "PC bitmap Windows 3.x format 269 x 40 x 24 image size 32320 cbSize 32374 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\Progress.bmp]- [targetUID: 00000000-00005652] "button1.bmp" has type "PC bitmap Windows 3.x format 80 x 120 x 24 image size 28802 resolution 2834 x 2834 px/m cbSize 28856 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\button1.bmp]- [targetUID: 00000000-00005652] "button2.bmp" has type "PC bitmap Windows 3.x format 80 x 120 x 24 image size 28802 resolution 2834 x 2834 px/m cbSize 28856 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\button2.bmp]- [targetUID: 00000000-00005652] "bottom2.bmp" has type "PC bitmap Windows 3.x format 43 x 42 x 24 image size 5544 cbSize 5598 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\bottom2.bmp]- [targetUID: 00000000-00005652] "bottom1.bmp" has type "PC bitmap Windows 3.x format 233 x 6 x 24 image size 4200 cbSize 4254 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\bottom1.bmp]- [targetUID: 00000000-00005652] "close.bmp" has type "PC bitmap Windows 3.x format 37 x 25 x 24 image size 2802 resolution 2834 x 2834 px/m cbSize 2856 bits offset 54"- Location: [%TEMP%\nswD1CB.tmp\close.bmp]- [targetUID: 00000000-00005652] "entries" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\entries]- [targetUID: 00000000-00005652] "all-wcprops" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\all-wcprops]- [targetUID: 00000000-00005652] "Slides.dat.svn-base" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\text-base\Slides.dat.svn-base]- [targetUID: 00000000-00005652] "Slides.dat.bak.svn-base" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\text-base\Slides.dat.bak.svn-base]- [targetUID: 00000000-00005652] "Thumbs.db.svn-base" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\prop-base\Thumbs.db.svn-base]- [targetUID: 00000000-00005652] "Thumbs.db.svn-base" has type "Composite Document File V2 Document Cannot read section info"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\text-base\Thumbs.db.svn-base]- [targetUID: 00000000-00005652] "Slide 01.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:11:13 10:54:53] baseline precision 8 535x328 components 3"- Location: [%TEMP%\nswD1CB.tmp\Slides\Slide 01.jpg]- [targetUID: 00000000-00005652] "Slide 02.jpg.svn-base" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:09:27 15:31:49] baseline precision 8 535x328 components 3"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\text-base\Slide 02.jpg.svn-base]- [targetUID: 00000000-00005652] "Slides.dat" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\nswD1CB.tmp\Slides\Slides.dat]- [targetUID: 00000000-00005652] "Slides.dat.bak" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\nswD1CB.tmp\Slides\Slides.dat.bak]- [targetUID: 00000000-00005652] "Slides.dat.bak.svn-base" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\prop-base\Slides.dat.bak.svn-base]- [targetUID: 00000000-00005652] "Slide 02.jpg.svn-base" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\prop-base\Slide 02.jpg.svn-base]- [targetUID: 00000000-00005652] "Slide 01.jpg.svn-base" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\prop-base\Slide 01.jpg.svn-base]- [targetUID: 00000000-00005652] "Slides.dat.svn-base" has type "ASCII text"- Location: [%TEMP%\nswD1CB.tmp\Slides\.svn\prop-base\Slides.dat.svn-base]- [targetUID: 00000000-00005652]34:T62a,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")35:T9ce,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\sihost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\svchost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\taskhostw.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\explorer.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\RuntimeBroker.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\dllhost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\ctfmon.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\UUS\amd64\MoNotificationUx.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\ApplicationFrameHost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\System32\oobe\UserOOBEBroker.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" (UID: 5652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" queries basic process information of the "C:\Windows\SysWOW64\cmd.exe" (UID: 5652)36:Tdb0,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "GENERAL_DISKMANAGER_ENG_WIN32_V2.02.1.R.170417.EXE"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "")37:T61b,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe.Local\" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\COMCTL32.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\comctl32.dll"38:Tac2,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\VERSION.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\FLTLIB.DLL" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\MSVCP140.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\CFGMGR32.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\FindProcDLL.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\SkinBtn.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\MSIMG32.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\RichEd20.DLL" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\USP10.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\msls31.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\ButtonEvent.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\nsDialogs.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\System.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\TextShaping.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\TestDLL.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\TestDLLENU.dll"39:Teff,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe.Local\" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\button1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\button2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header3.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header1_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header2_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Header3_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Progress.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\ProgressBar.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\welcome.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\lincese.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\finish.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\finish_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\bottom.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\close.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\un1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\unHeader.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\bottom1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\bottom2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slide 01.jpg" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slide 02.jpg" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slides.dat" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slides.dat.bak"3a:T61c,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\findprocdll.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\button1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\skinbtn.dll" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\button2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header1.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header2.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header3.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header1_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header2_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\header3_en.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\progress.bmp" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes file "c:\users\%osuser%\appdata\local\temp\nswd1cb.tmp\progressbar.bmp"3b:T568,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slides.dat" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Slides.dat.bak" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\Thumbs.db" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\prop-base\Slides.dat.bak.svn-base" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\prop-base\Slides.dat.svn-base" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\prop-base\Thumbs.db.svn-base" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\text-base\Slides.dat.bak.svn-base" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\text-base\Slides.dat.svn-base" "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\Slides\.svn\text-base\Thumbs.db.svn-base"3c:T551,Found registry query API: "RegEnumValueA" in file "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" Found registry query API: "RegEnumKeyA" in file "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" Found registry query API: "RegQueryValueExA" in file "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" Found registry query API: "RegOpenKeyExA" in file "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" Found registry query API: "RegEnumValueA" in "00000000-00005652.00000001.181772.00407000.00000002.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00005652.00000001.181772.00407000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005652.00000001.181772.00407000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005652.00000001.181772.00407000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00005652.00000003.191120.007C3000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005652.00000003.191120.007C3000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005652.00000003.191120.007C3000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00005652.00000003.191120.007C3000.00000002.mdmp" Found registry query API: "RegQueryValueW" in "00000000-00005652.00000003.191120.007C3000.00000002.mdmp"3d:Tea8,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\button1.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\button2.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header1.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header2.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header3.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header1_en.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header2_en.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Header3_en.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Progress.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\ProgressBar.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\welcome.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\lincese.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\finish.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\finish_en.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\bottom.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\close.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\un1.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\unHeader.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\bottom1.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\bottom2.bmp (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Slides\Slide 01.jpg (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Slides\Slide 02.jpg (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Slides\Slides.dat (UID: 00000000-00005652) "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" called "FindFirstFileA" with parameter %TEMP%\nswD1CB.tmp\Slides\Slides.dat.bak (UID: 00000000-00005652)3e:T5e3,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "SkinBtn.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")3f:Tb6a,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005652.00000001.181772.00407000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005652.00000002.183690.025B3000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005652.00000003.191120.007C3000.00000002.mdmp")40:T5ac,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000000.179851.02420000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.023A0000.00000004.mdmp, 00000000-00005652.00000003.191120.02420000.00000004.mdmp, 00000000-00005652.00000003.191120.02880000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000000.179851.02420000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.023A0000.00000004.mdmp, 00000000-00005652.00000003.191120.02420000.00000004.mdmp, 00000000-00005652.00000003.191120.02880000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp")41:T420,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp")42:Tf43,"un1.bmp" has type "PC bitmap Windows 3.x format 536 x 357 x 24 image size 574058 resolution 2834 x 2834 px/m cbSize 574112 bits offset 54" and extension "bmp" "finish.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54" and extension "bmp" "finish_en.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54" and extension "bmp" "welcome.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527426 resolution 2834 x 2834 px/m cbSize 527480 bits offset 54" and extension "bmp" "lincese.bmp" has type "PC bitmap Windows 3.x format 536 x 328 x 24 image size 527424 resolution 2834 x 2834 px/m cbSize 527478 bits offset 54" and extension "bmp" "ProgressBar.bmp" has type "PC bitmap Windows 3.x format 535 x 42 x 24 image size 67538 resolution 2834 x 2834 px/m cbSize 67592 bits offset 54" and extension "bmp" "bottom.bmp" has type "PC bitmap Windows 3.x format 536 x 42 x 24 image size 67538 resolution 2834 x 2834 px/m cbSize 67592 bits offset 54" and extension "bmp" "Slide 02.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:09:27 15:31:49] baseline precision 8 535x328 components 3" and extension "jpg" "Header3_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Header1.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "unHeader.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Header2.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Header1_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Header2_en.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Header3.bmp" has type "PC bitmap Windows 3.x format 536 x 28 x 24 image size 45026 resolution 2834 x 2834 px/m cbSize 45080 bits offset 54" and extension "bmp" "Progress.bmp" has type "PC bitmap Windows 3.x format 269 x 40 x 24 image size 32320 cbSize 32374 bits offset 54" and extension "bmp" "button1.bmp" has type "PC bitmap Windows 3.x format 80 x 120 x 24 image size 28802 resolution 2834 x 2834 px/m cbSize 28856 bits offset 54" and extension "bmp" "button2.bmp" has type "PC bitmap Windows 3.x format 80 x 120 x 24 image size 28802 resolution 2834 x 2834 px/m cbSize 28856 bits offset 54" and extension "bmp" "bottom2.bmp" has type "PC bitmap Windows 3.x format 43 x 42 x 24 image size 5544 cbSize 5598 bits offset 54" and extension "bmp" "bottom1.bmp" has type "PC bitmap Windows 3.x format 233 x 6 x 24 image size 4200 cbSize 4254 bits offset 54" and extension "bmp" "close.bmp" has type "PC bitmap Windows 3.x format 37 x 25 x 24 image size 2802 resolution 2834 x 2834 px/m cbSize 2856 bits offset 54" and extension "bmp" "Slide 01.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2013:11:13 10:54:53] baseline precision 8 535x328 components 3" and extension "jpg"43:Tcc0,Found string "MulDiv" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "DeleteFileA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeProcess" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe, API is part of module: KERNELBASE.DLL)44:Ta4e,"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\FindProcDLL.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\SkinBtn.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\ButtonEvent.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nswD1CB.tmp\TestDLL.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMAAAAjAAcAAAh3Z3d3d3d3d3d3c2R4gAAIiIiIiIiIiIiIiIiIiIAACIiIiIiIiIiIiIiIiIiAAAiIiIiIiIh3iIiIiIiIcAAIiIiIiIh3d3eIiIiIiHAACIiIiIcyeIiHIniIiIiAAAiIiIh3eP///4c3iIiIgAAIiIiHeIiPd///h3iIiIAACIiIg4iIiHf//4gniIiAAAiIiCiIeIh3j4eIgoiIgAAIiIh/h3eHd3h3eIeIiIAACIiH//93d3d3d4iIeIiAAAiIh///d3d3d3eIiHiIgAAIiIf/iHd4j4d3iP94iIAACIiH+Hd3f4iHd3ePeIiAAAiIh/gAd3iI93cAj3iIgAAIiIf/h3d4/4d3iP94iIAACIiIiIh3d3d3d///iIiAAAiIiIiId3d3d3f//4iIgAAIiIh4h3d3d3d3f/eIiIAACIiIiIh3+HeId4+IiIiAAAiIiIiI//9wiIiIiIiIgAAIiIiIiP//d4iIiIiIiIAACIiI//iI///4iI//iIiAAAiIiP//iIiIiI//+IiIgAAIiIj///////////+IiIAACIiI////////////iIiAAAiIiP///////////4iIgAAAiIj///////////+IiAAAAAAAAAAAAAAAAAAAAAAADgAAAH4AAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPgAAAD/////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 8538f39c7fe3… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 8538f39c7fe3…. Threat score 0/100. 0/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\",\"applicationCategory\":[\"compressed\",\"7zip\"],\"identifier\":\"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":26},\"behavioralIndicators\":{\"malicious\":1,\"suspicious\":11},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792569637104,"unified_at":"2026-10-21T08:00:37.104Z","metadata":{"hashes":{"sha256":"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","sha1":"5f85b9956bdeb76f3c8531cf987d8623ed1bc279","md5":"55297d5d3635288b478089e43299b3cf","sha512":"8d603d5415d7dbd5d7e9f71b5953a1dc0461e5f5fe3ebcfef66fe60e676bf44f7faad704c482ec091acf225e69833afc4ad499be0a3b20e4a6c97e4b6866755e","ssdeep":"393216:gNXGa4DOQ8QfPXDGb0Yon0ihRhtOCM0D9WDxf4ALWYdnZ:gNXPlQ3Do0YovhU/kA5qwZ","ssdeep_chunks":["393216:gNXGa4D","393216:NXGa4DO","393216:XGa4DOQ","393216:Ga4DOQ8","393216:a4DOQ8Q","393216:4DOQ8Qf","393216:DOQ8QfP","393216:OQ8QfPX","393216:Q8QfPXD","393216:8QfPXDG","393216:QfPXDGb","393216:fPXDGb0","393216:PXDGb0Y","393216:XDGb0Yo","393216:DGb0Yon","393216:Gb0Yon0","393216:b0Yon0i","393216:0Yon0ih","393216:Yon0ihR","393216:on0ihRh","393216:n0ihRht","393216:0ihRhtO","393216:ihRhtOC","393216:hRhtOCM","393216:RhtOCM0","393216:htOCM0D","393216:tOCM0D9","393216:OCM0D9W","393216:CM0D9WD","393216:M0D9WDx","393216:0D9WDxf","393216:D9WDxf4","393216:9WDxf4A","393216:WDxf4AL","393216:Dxf4ALW","393216:xf4ALWY","393216:f4ALWYd","393216:4ALWYdn","393216:ALWYdnZ","786432:gNXGa4D","786432:NXGa4DO","786432:XGa4DOQ","786432:Ga4DOQ8","786432:a4DOQ8Q","786432:4DOQ8Qf","786432:DOQ8QfP","786432:OQ8QfPX","786432:Q8QfPXD","786432:8QfPXDG","786432:QfPXDGb","786432:fPXDGb0","786432:PXDGb0Y","786432:XDGb0Yo","786432:DGb0Yon","786432:Gb0Yon0","786432:b0Yon0i","786432:0Yon0ih","786432:Yon0ihR","786432:on0ihRh","786432:n0ihRht","786432:0ihRhtO","786432:ihRhtOC","786432:hRhtOCM","786432:RhtOCM0","786432:htOCM0D","786432:tOCM0D9","786432:OCM0D9W","786432:CM0D9WD","786432:M0D9WDx","786432:0D9WDxf","786432:D9WDxf4","786432:9WDxf4A","786432:WDxf4AL","786432:Dxf4ALW","786432:xf4ALWY","786432:f4ALWYd","786432:4ALWYdn","786432:ALWYdnZ","393216:gNXPlQ3","393216:NXPlQ3D","393216:XPlQ3Do","393216:PlQ3Do0","393216:lQ3Do0Y","393216:Q3Do0Yo","393216:3Do0Yov","393216:Do0Yovh","393216:o0YovhU","393216:0YovhU/","393216:YovhU/k","393216:ovhU/kA","393216:vhU/kA5","393216:hU/kA5q","393216:U/kA5qw","393216:/kA5qwZ"],"imphash":"7fa974366048f9c551ef45714595665e","pehash":"f71a6a13bfa3f18a7addd0d3eb0cb17eb51dacd8"},"file_info":{"file_name":"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":16189811,"entropy":8,"compile_timestamp":"2009-12-05T22:50:41","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792569332000,"last_seen":1792569333000,"last_multi_scan":1792569333000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":22738,"raw_size":23040},{"name":".rdata","virtual_address":"0x7000","virtual_size":4496,"raw_size":4608},{"name":".data","virtual_address":"0x9000","virtual_size":110456,"raw_size":1024},{"name":".ndata","virtual_address":"0x24000","virtual_size":106496},{"name":".rsrc","virtual_address":"0x3e000","virtual_size":11416,"raw_size":11776}],"section_names":[".text",".rdata",".data",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["nsis"]}]},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":134,"suspicious_count":11,"malicious_count":1,"total":146},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"Tries to obtain the highest possible privilege level without UAC dialog"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a computer-based training (CBT) hook"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops document files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"suspicious","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"System.dll\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00005652)\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"FindResourceW\" with parameter \"3001\" - (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"LoadResource with parameter {'hModule': '7995392', 'hResInfo': '8203240'}\" (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"CallWindowProc\"; File: \"ButtonEvent.dll\")\n file/memory contains long string with (Indicator: \"CallWindowProc\"; File: \"SkinBtn.dll\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1718273830 [PID: 5652]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1718280465 [PID: 5652]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1718502377 [PID: 5652]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1718508786 [PID: 5652]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1719031391 [PID: 5652]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried SystemProcessInformation at 00000000-00005652-00000C15-1719037758 [PID: 5652]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"TestDLL.dll\" at offset 184496; code bytes = 30d0\n Found XOR loop in file \"TestDLL.dll\" at offset 379615; code bytes = 30d0\n Found XOR loop in file \"TestDLL.dll\" at offset 379735; code bytes = 30d0\n Found XOR loop in file \"TestDLL.dll\" at offset 381069; code bytes = 30d0\n Found XOR loop in file \"TestDLL.dll\" at offset 63724; code bytes = 33c1\n Found XOR loop in file \"TestDLL.dll\" at offset 71312; code bytes = 33c1\n Found XOR loop in file \"TestDLL.dll\" at offset 71911; code bytes = 33c1\n Found XOR loop in file \"TestDLL.dll\" at offset 98976; code bytes = 33c1\n Found XOR loop in file \"TestDLL.dll\" at offset 127380; code bytes = 33c1\n Found XOR loop in file \"TestDLL.dll\" at offset 37785; code bytes = 8030\n Found XOR loop in file \"TestDLL.dll\" at offset 382188; code bytes = 8030\n Found XOR loop in file \"FindProcDLL.dll\" at offset 31285; code bytes = 30d0\n Found XOR loop in file \"nsDialogs.dll\" at offset 3077; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"GetCursorPos\"; File: \"TestDLL.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"FindProcDLL.dll\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DiskManager\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoA\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetWindowTextW\" (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetActiveWindow\" (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"FindWindowExA\"; File: \"ButtonEvent.dll\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSWD1CB.TMP\\FINDPROCDLL.DLL\n %TEMP%\\NSWD1CB.TMP\\TESTDLL.DLL\n %TEMP%\\NSWD1CB.TMP\\BUTTONEVENT.DLL\n %TEMP%\\NSWD1CB.TMP\\SYSTEM.DLL\n %TEMP%\\NSWD1CB.TMP\\SKINBTN.DLL\n %TEMP%\\NSWD1CB.TMP\\NSDIALOGS.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried token user identity (UID: 00000000-00005652)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"TestDLL.dll\")\n file/memory contains long string(File: \"FindProcDLL.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$29","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000002.183690.025B3000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"TestDLL.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"FindProcDLL.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"nsDialogs.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"ButtonEvent.dll\" as clean (type is \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"SkinBtn.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" failed to load missing module \"%TEMP%\\nswD1CB.tmp\\TestDLLENU.dll\" - [base:0; Status:c0000135]\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" failed to load missing module \"%TEMP%\\nswD1CB.tmp\\TestDLLLOC.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ButtonEvent.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73E40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76130000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75740000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$31","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 4252","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"TestDLL.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"FindProcDLL.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsDialogs.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ButtonEvent.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"SkinBtn.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$32","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$33","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"TestDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\TestDLL.dll]- [targetUID: 00000000-00005652]\n \"FindProcDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\FindProcDLL.dll]- [targetUID: 00000000-00005652]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\System.dll]- [targetUID: 00000000-00005652]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\nsDialogs.dll]- [targetUID: 00000000-00005652]\n \"ButtonEvent.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\ButtonEvent.dll]- [targetUID: 00000000-00005652]\n \"SkinBtn.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\SkinBtn.dll]- [targetUID: 00000000-00005652]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$35","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" reads file \"c:\\general_diskmanager_eng_win32_v2.02.1.r.170417.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3a","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$3b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"framepop.png\" [Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp\n 00000000-00005652.00000001.181772.004E0000.00000004.mdmp\n 00000000-00005652.00000002.183690.004E0000.00000004.mdmp\n 00000000-00005652.00000003.191120.004E0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\"\n Heuristic match: \"xe.gt\"\n Heuristic match: \"z,.sa\"\n Heuristic match: \"du.nl\"\n Pattern match: \"ns.adobe.com/xap/1.0/\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://nsis.sf.net/nsis_errorerror\" - Source: \"00000000-00005652.00000001.181772.00409000.00000004.mdmp\")\n Found URL \"http://nsis.sf.net/nsis_errorerror\" - Source: \"00000000-00005652.00000003.191120.00409000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"CreateCompatibleDC\"; File: \"SkinBtn.dll\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"SkinBtn.dll\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"7) Confidentiality: Unless there is prior written notice from the company, you will reveal software performace, evaluation results, testing results, technical secret or any other confidential information of the same level to any third party.\" (Indicator: \"secret\"; Source: \"00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00005652.00000000.179851.004E0000.00000004.mdmp, 00000000-00005652.00000001.181772.004E0000.00000004.mdmp, 00000000-00005652.00000002.183690.004E0000.00000004.mdmp, 00000000-00005652.00000003.191120.004E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DiskManager\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp\n 00000000-00005652.00000001.181772.004E0000.00000004.mdmp\n 00000000-00005652.00000002.183690.004E0000.00000004.mdmp\n 00000000-00005652.00000003.191120.004E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"\n Found registry deletion API: \"RegDeleteKeyExA\" in file \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExA\" in \"00000000-00005652.00000001.181772.00409000.00000004.mdmp, 00000000-00005652.00000003.191120.00409000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$40","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00005652.00000000.179851.004E0000.00000004.mdmp\n 00000000-00005652.00000001.181772.004E0000.00000004.mdmp\n 00000000-00005652.00000002.183690.004E0000.00000004.mdmp\n 00000000-00005652.00000003.191120.004E0000.00000004.mdmp\n 00000000-00005652.00000003.191120.02880000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp, 00000000-00005652.00000003.191120.007C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005652.00000001.181772.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops document files inside temp directory","description":"\"Thumbs.db\" has type \"Composite Document File V2 Document Cannot read section info\"- Location: [%TEMP%\\nswD1CB.tmp\\Slides\\Thumbs.db]- [targetUID: 00000000-00005652]\n \"Thumbs.db.svn-base\" has type \"Composite Document File V2 Document Cannot read section info\"- Location: [%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Thumbs.db.svn-base]- [targetUID: 00000000-00005652]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-34","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"TestDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\TestDLL.dll]- [targetUID: 00000000-00005652]\n \"FindProcDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\FindProcDLL.dll]- [targetUID: 00000000-00005652]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\System.dll]- [targetUID: 00000000-00005652]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\nsDialogs.dll]- [targetUID: 00000000-00005652]\n \"ButtonEvent.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\ButtonEvent.dll]- [targetUID: 00000000-00005652]\n \"SkinBtn.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\SkinBtn.dll]- [targetUID: 00000000-00005652]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\Thumbs.db\" has high entropy 7.40178\n Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slide 01.jpg.svn-base\" has high entropy 7.54458\n Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Thumbs.db.svn-base\" has high entropy 7.40178\n Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slide 02.jpg.svn-base\" has high entropy 7.51954","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\Slide 02.jpg\" has high entropy 7.51954\n Dropped file \"%TEMP%\\nswD1CB.tmp\\Slides\\Slide 01.jpg\" has high entropy 7.54458","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"TestDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\TestDLL.dll]- [targetUID: 00000000-00005652]\n \"FindProcDLL.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\FindProcDLL.dll]- [targetUID: 00000000-00005652]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\System.dll]- [targetUID: 00000000-00005652]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\nsDialogs.dll]- [targetUID: 00000000-00005652]\n \"ButtonEvent.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\ButtonEvent.dll]- [targetUID: 00000000-00005652]\n \"SkinBtn.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nswD1CB.tmp\\SkinBtn.dll]- [targetUID: 00000000-00005652]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$44","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsbD14D.tmp\" with delete access\n \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nswD1CB.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"suspicious","category":"System Security","name":"Tries to obtain the highest possible privilege level without UAC dialog","description":"\"Nullsoft Install System v2.46\" (Indicator: \"requestedExecutionLevel level=\"highestAvailable\"\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":7,"id":"string-31","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe\" sets a callback procedure (7a7e41) using filter \"WH_CBT\" for process ID: 1614","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}],"intel_graph":{"map":{"File:044632d6ddf430a721170ff037c702281f7df623267d9c38cfe06bd3e03bff58":{"type":"File","value":"044632d6ddf430a721170ff037c702281f7df623267d9c38cfe06bd3e03bff58","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:097c218e38b7aa560b3ab75c2175458bcb1fff19abb27a03bd18fecc8767a858":{"type":"File","value":"097c218e38b7aa560b3ab75c2175458bcb1fff19abb27a03bd18fecc8767a858"},"File:0b335d6c819bda2640fca034bf370850455a396195e119a2dd2f57a83bb5c7aa":{"type":"File","value":"0b335d6c819bda2640fca034bf370850455a396195e119a2dd2f57a83bb5c7aa","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:0bb072f8d39cdc1aa4a0844d1520874f260397809eea6d648155a4bc5cd9927c":{"type":"File","value":"0bb072f8d39cdc1aa4a0844d1520874f260397809eea6d648155a4bc5cd9927c","filetype":"HTML document, ASCII text","filetype_short":"HTML","mime_type":"application/javascript"},"File:0c66e4dfe9e05c318cbb2fef0c4e7fb7efa1210f218e4141d5d4f5648ce9adc4":{"type":"File","value":"0c66e4dfe9e05c318cbb2fef0c4e7fb7efa1210f218e4141d5d4f5648ce9adc4"},"File:0c6aafc28cbdfeeca7412f377210e520f55de64cbe5c85d71528f0e16f51f36e":{"type":"File","value":"0c6aafc28cbdfeeca7412f377210e520f55de64cbe5c85d71528f0e16f51f36e","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:0d307434e22558391a4a851b28366592cc54ffca943539bc78ca1aa8984cc0c9":{"type":"File","value":"0d307434e22558391a4a851b28366592cc54ffca943539bc78ca1aa8984cc0c9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:0fa6c61111f541d9742747b7c89cd1ee5622da5fdb48b4b258f4a8c76aebc9f1":{"type":"File","value":"0fa6c61111f541d9742747b7c89cd1ee5622da5fdb48b4b258f4a8c76aebc9f1","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:108f514a38839ec5fd633d24ae869f4f212705a6ff46cfc27fe79622a5b30b77":{"type":"File","value":"108f514a38839ec5fd633d24ae869f4f212705a6ff46cfc27fe79622a5b30b77","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=536], baseline, precision 8, 536x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:13f558b0e5d992b39e5615254c90e05fde335285c2fa25a824b58108f5b475b8":{"type":"File","value":"13f558b0e5d992b39e5615254c90e05fde335285c2fa25a824b58108f5b475b8","filetype":"Unicode text, UTF-8 text, with very long lines (700)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:140d81cab8ecb5bb2dc435ea0c159248199852f49ea551a07656a4607d4e6050":{"type":"File","value":"140d81cab8ecb5bb2dc435ea0c159248199852f49ea551a07656a4607d4e6050","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:15623c122bc63dfb29c5781f256cae2c049fbcb125823229719df986742b45b8":{"type":"File","value":"15623c122bc63dfb29c5781f256cae2c049fbcb125823229719df986742b45b8","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 535x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e":{"type":"File","value":"168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:16f46cba85622c3fee5931056332b38fbedebf327466fa4a9e1cce36164e5a57":{"type":"File","value":"16f46cba85622c3fee5931056332b38fbedebf327466fa4a9e1cce36164e5a57","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:173e119c9dbc68d965058dca4c5deb56a0596de91edf96c8bff346d8dcc1db74":{"type":"File","value":"173e119c9dbc68d965058dca4c5deb56a0596de91edf96c8bff346d8dcc1db74","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:17bf96e421f3fb3531c5d5c3f93ec33f5691538b10c2729f518950bb8cc1d2dd":{"type":"File","value":"17bf96e421f3fb3531c5d5c3f93ec33f5691538b10c2729f518950bb8cc1d2dd","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:1cc0a36d4b3cabf92deb10c25aa3030ef3927ad15ece152696b72d74059e2b34":{"type":"File","value":"1cc0a36d4b3cabf92deb10c25aa3030ef3927ad15ece152696b72d74059e2b34","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:1e918b00ded2e2bdd568b78bfd3b51f33fb17b1645356c790d15b8caa354e8bc":{"type":"File","value":"1e918b00ded2e2bdd568b78bfd3b51f33fb17b1645356c790d15b8caa354e8bc","filetype":"PC bitmap, Windows 3.x format, 536 x 328 x 24, image size 527426, resolution 2834 x 2834 px/m, cbSize 527480, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:1f20c230c3d0c38f01503b7260ab4cbc31db2095e6fe0a38e7809050979deb4f":{"type":"File","value":"1f20c230c3d0c38f01503b7260ab4cbc31db2095e6fe0a38e7809050979deb4f","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:2220dda740ea76e8eb68cc7f45dcf66aec8c05e01a6824df3d7403e04878a707":{"type":"File","value":"2220dda740ea76e8eb68cc7f45dcf66aec8c05e01a6824df3d7403e04878a707","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:23a75ac4695201df7eb0538a5fd1d9b600198b0471509373c5df69488ec0ba41":{"type":"File","value":"23a75ac4695201df7eb0538a5fd1d9b600198b0471509373c5df69488ec0ba41","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:2b2215a2f821dc568dbfa27e7d800df5fe0da6b9fbface93efc0d294571444c3":{"type":"File","value":"2b2215a2f821dc568dbfa27e7d800df5fe0da6b9fbface93efc0d294571444c3","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:2eceb6faa12c81d655cb3e809e8a76c83c6c1caba033ca3ae413fc390ad1059f":{"type":"File","value":"2eceb6faa12c81d655cb3e809e8a76c83c6c1caba033ca3ae413fc390ad1059f","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:31f0ce1506413284c1b5efe279478c0fe9dceba110b000446aff21beef9355d6":{"type":"File","value":"31f0ce1506413284c1b5efe279478c0fe9dceba110b000446aff21beef9355d6","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:3281d8608e5857aaca50ba5071a6236f2dfc856229b452889c75fcf40103af2e":{"type":"File","value":"3281d8608e5857aaca50ba5071a6236f2dfc856229b452889c75fcf40103af2e","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:32ed02d0cd57b4dbf545e187e85d32e60453a74c21fce0b6fb1b975daba94cea":{"type":"File","value":"32ed02d0cd57b4dbf545e187e85d32e60453a74c21fce0b6fb1b975daba94cea","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 535x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:35b3a42bf445b052aaef48ee881bf81698e5272d36c2d8432b118aff602bfdb7":{"type":"File","value":"35b3a42bf445b052aaef48ee881bf81698e5272d36c2d8432b118aff602bfdb7","filetype":"Unicode text, UTF-8 text, with very long lines (603)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:3b97604b24eb122f22c561bfbf8c6b816abbfa6fa78b7f5e5848561a4cbd4b7a":{"type":"File","value":"3b97604b24eb122f22c561bfbf8c6b816abbfa6fa78b7f5e5848561a4cbd4b7a","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:3dfddd47ba94f1d31d4427fe981ab71a16979120318bfd955d2c3883656421b9":{"type":"File","value":"3dfddd47ba94f1d31d4427fe981ab71a16979120318bfd955d2c3883656421b9","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:3f65deb75ec7f44c881505b47d54401f9538a88cf447f5f40601b76cf30c84ad":{"type":"File","value":"3f65deb75ec7f44c881505b47d54401f9538a88cf447f5f40601b76cf30c84ad","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:3fdafba4663a60b385315966ef64cb99999106e6cf8e86724ec9c7f296c1b698":{"type":"File","value":"3fdafba4663a60b385315966ef64cb99999106e6cf8e86724ec9c7f296c1b698","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:40844872b38521586590b413c01bf5ee42abd6398cb65d7e8217ce90c6ea0bf7":{"type":"File","value":"40844872b38521586590b413c01bf5ee42abd6398cb65d7e8217ce90c6ea0bf7","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:40883639312b636129f99841aaddee60e3434a5647726a49d94ca98a04377c6e":{"type":"File","value":"40883639312b636129f99841aaddee60e3434a5647726a49d94ca98a04377c6e","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:41965757945dae3a01a12571fddefe8c35d105d6f88e8d9add205bdd170e8232":{"type":"File","value":"41965757945dae3a01a12571fddefe8c35d105d6f88e8d9add205bdd170e8232","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 43 x 42 x 24, image size 5544, cbSize 5598, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1":{"type":"File","value":"42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:43e386ac435a84a3a332861c0df01556a9dcdbf448a3b263abba98f6085a21a0":{"type":"File","value":"43e386ac435a84a3a332861c0df01556a9dcdbf448a3b263abba98f6085a21a0","filetype":"Unicode text, UTF-8 text, with very long lines (602)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:44475982c48ad449fdfc16b278ab4c31a4d481c1b4fb463777840d0974d3c308":{"type":"File","value":"44475982c48ad449fdfc16b278ab4c31a4d481c1b4fb463777840d0974d3c308","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS6 (Windows), datetime=2013:09:24 17:02:16], baseline, precision 8, 535x357, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:44db922493e218abb12cab8a8a65f2e4f6441d251ebbd0ad793455b0fdb9d467":{"type":"File","value":"44db922493e218abb12cab8a8a65f2e4f6441d251ebbd0ad793455b0fdb9d467","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:49d5368f3b0bc0aee9d9fca3564463bc3e80bc1811f4492a0abd4577f6f2ed47":{"type":"File","value":"49d5368f3b0bc0aee9d9fca3564463bc3e80bc1811f4492a0abd4577f6f2ed47","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2013:09:27 15:31:49], baseline, precision 8, 535x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:4a00802a65d683c1176d616a6cd3761b3760341ecb8fc15d08c5c4210f56fb44":{"type":"File","value":"4a00802a65d683c1176d616a6cd3761b3760341ecb8fc15d08c5c4210f56fb44","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:4a10d95dfc1b713b91c6122a562fc9c616eda213088899b5c0c158c32362e92d":{"type":"File","value":"4a10d95dfc1b713b91c6122a562fc9c616eda213088899b5c0c158c32362e92d","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:4acd51c08998749081f5596eafc1064a209e751e2d3d070739ab1f2c2bdbc21f":{"type":"File","value":"4acd51c08998749081f5596eafc1064a209e751e2d3d070739ab1f2c2bdbc21f","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:4d73fd6b76097643c8df005e2464a116c0f7daa5daa89ea698baa3ec85ad98de":{"type":"File","value":"4d73fd6b76097643c8df005e2464a116c0f7daa5daa89ea698baa3ec85ad98de","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:4e026a9e955738d381db08e29e74edad36a70f4cda5a5c674be1147b3b875602":{"type":"File","value":"4e026a9e955738d381db08e29e74edad36a70f4cda5a5c674be1147b3b875602","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:4f1b097f5720f4f010eec0c656020b740766a3ad1aa2efc5d8844b0c9ccc1a9f":{"type":"File","value":"4f1b097f5720f4f010eec0c656020b740766a3ad1aa2efc5d8844b0c9ccc1a9f","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a":{"type":"File","value":"4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b":{"type":"File","value":"51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:51e72bb6b06f2b87cd6682b31f585c498664e46c26f8aab4229fa0ff5a022aad":{"type":"File","value":"51e72bb6b06f2b87cd6682b31f585c498664e46c26f8aab4229fa0ff5a022aad","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:523fbf9c903b35a107394fb91d120f8b9732b7c150b1b2eb57714d3921ab5dc8":{"type":"File","value":"523fbf9c903b35a107394fb91d120f8b9732b7c150b1b2eb57714d3921ab5dc8","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:52793ab7ef8f8e75d3ac37c18c98468fbb3ee2cb7345f4455912926280a9ac70":{"type":"File","value":"52793ab7ef8f8e75d3ac37c18c98468fbb3ee2cb7345f4455912926280a9ac70","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:542c749b34eec28d9d8751a61b6451b56046fcddc8bcbd5a2c7ffbce254705d3":{"type":"File","value":"542c749b34eec28d9d8751a61b6451b56046fcddc8bcbd5a2c7ffbce254705d3","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:546eaad54da0041bd33ea35c609ca835ed71908d584ea7bef50ec70e93d708da":{"type":"File","value":"546eaad54da0041bd33ea35c609ca835ed71908d584ea7bef50ec70e93d708da","filetype":"Unicode text, UTF-8 text","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:551adc4d7ed627746cf1213ac49ebe80c798bfdf825f53a6eab21395314c607e":{"type":"File","value":"551adc4d7ed627746cf1213ac49ebe80c798bfdf825f53a6eab21395314c607e","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999":{"type":"File","value":"57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 535 x 42 x 24, image size 67538, resolution 2834 x 2834 px/m, cbSize 67592, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:595fb3c20262041b53bd2557011a40179f607c078a0076b783248018bcdf4c36":{"type":"File","value":"595fb3c20262041b53bd2557011a40179f607c078a0076b783248018bcdf4c36","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:5c5f0f73d4f26bd211581125d1f8d0e07e5dee3d39cb88568e56cdc6d631df03":{"type":"File","value":"5c5f0f73d4f26bd211581125d1f8d0e07e5dee3d39cb88568e56cdc6d631df03","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:5cffe1ec979622a55cada9b9c191df476a887c6f0c4a7046382cd0f8848c9743":{"type":"File","value":"5cffe1ec979622a55cada9b9c191df476a887c6f0c4a7046382cd0f8848c9743","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=536], baseline, precision 8, 536x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:60b3d23ef2cb8378682d402506b19cd849384858df0a09ccf7b18b22394ad663":{"type":"File","value":"60b3d23ef2cb8378682d402506b19cd849384858df0a09ccf7b18b22394ad663","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:6344b8057288701c7d78b0d2d205b82af40eec86f718d3dfbfd5f0dc1b101ca7":{"type":"File","value":"6344b8057288701c7d78b0d2d205b82af40eec86f718d3dfbfd5f0dc1b101ca7","filetype":"Composite Document File V2 Document, Cannot read section info","filetype_short":"CDF","mime_type":"image/vnd.ms-thumb"},"File:6dcbd877fb10f004f0bb0508ca1dd6950e26245328f1910fe1baeb4b3ef4aba7":{"type":"File","value":"6dcbd877fb10f004f0bb0508ca1dd6950e26245328f1910fe1baeb4b3ef4aba7","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:6f402cbd0c226691088af597372776a111f718cd1abf8b2d2fa7837097e6cce2":{"type":"File","value":"6f402cbd0c226691088af597372776a111f718cd1abf8b2d2fa7837097e6cce2","filetype":"HTML document, ASCII text","filetype_short":"HTML","mime_type":"application/javascript"},"File:71fac56a7186a41158be253d7665209e3bb29d314a77cbaa4d1a83f51bee7cc8":{"type":"File","value":"71fac56a7186a41158be253d7665209e3bb29d314a77cbaa4d1a83f51bee7cc8","filetype":"JavaScript source, ASCII text, with very long lines (1685)","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:7416244a54047b76eb738f2086fba0b67555d6d67910fcc0502209d1fa100618":{"type":"File","value":"7416244a54047b76eb738f2086fba0b67555d6d67910fcc0502209d1fa100618","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:744d7088c68a966552107bc2a4b8a1c03650add1bc011b5dcb7a2815288898c3":{"type":"File","value":"744d7088c68a966552107bc2a4b8a1c03650add1bc011b5dcb7a2815288898c3","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:75cef7ef141fbbdd40980161bb7f451bbe19dbd6bef8d015cf8d5100c8b06d20":{"type":"File","value":"75cef7ef141fbbdd40980161bb7f451bbe19dbd6bef8d015cf8d5100c8b06d20","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:76aac6cb857cff28ccbc1f54fe596e6e722b39e7f76a2bd30985de36b48e0691":{"type":"File","value":"76aac6cb857cff28ccbc1f54fe596e6e722b39e7f76a2bd30985de36b48e0691","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:7b52572496fa44d8bab5c1c815d9c6eeaaf59479a2c2a93be898e48d0701cb79":{"type":"File","value":"7b52572496fa44d8bab5c1c815d9c6eeaaf59479a2c2a93be898e48d0701cb79","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:7c36f47a2c8620a856744215635c718edc0d7972fd0d02c0a8bf805337a1dca3":{"type":"File","value":"7c36f47a2c8620a856744215635c718edc0d7972fd0d02c0a8bf805337a1dca3","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:7d936aebee57e04338308ed8c52ce2c24e21b2978721326be3eb9e90c080834e":{"type":"File","value":"7d936aebee57e04338308ed8c52ce2c24e21b2978721326be3eb9e90c080834e","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7e866217e8638f93fa63e554a1845e92eb4f835a6f692bec783206edcd9e8649":{"type":"File","value":"7e866217e8638f93fa63e554a1845e92eb4f835a6f692bec783206edcd9e8649","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:7fd44a9a619400de5d7e09caed4252ce29607b05c1fc16de17f621422c1e1673":{"type":"File","value":"7fd44a9a619400de5d7e09caed4252ce29607b05c1fc16de17f621422c1e1673","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:801f5c50e8e4eb2e1b59c5ee4bcea351a23214b71f6b28fb8ba53642dbceedd2":{"type":"File","value":"801f5c50e8e4eb2e1b59c5ee4bcea351a23214b71f6b28fb8ba53642dbceedd2","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:827a70e802ab513277a574bd791ff28b85a0c29e86722c7f4df61dcaaaae05c0":{"type":"File","value":"827a70e802ab513277a574bd791ff28b85a0c29e86722c7f4df61dcaaaae05c0","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979":{"type":"File","value":"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:86818fedfc2bd0a2760049e5cb1223b065bb8e618a7a0635ce59bb7ba34a8c65":{"type":"File","value":"86818fedfc2bd0a2760049e5cb1223b065bb8e618a7a0635ce59bb7ba34a8c65","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 535x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:8717f2d18e86a315edd8077780c138af9aed72b336b499346f830a0ba9fcdfed":{"type":"File","value":"8717f2d18e86a315edd8077780c138af9aed72b336b499346f830a0ba9fcdfed","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:87e3d87b50fd24ee240bf0c49a1df279d568c4de0f89245bdeb3ba39a0d51cc1":{"type":"File","value":"87e3d87b50fd24ee240bf0c49a1df279d568c4de0f89245bdeb3ba39a0d51cc1","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:87e4f549665a4cbb8c4455a9eed07318d149f5ea684394b507170df7ff03f125":{"type":"File","value":"87e4f549665a4cbb8c4455a9eed07318d149f5ea684394b507170df7ff03f125","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff":{"type":"File","value":"888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:8a70cea5b779456fd0109bd43a5cc6359ea4cc2b6c3d3fe7780dfd6aeb0a1b54":{"type":"File","value":"8a70cea5b779456fd0109bd43a5cc6359ea4cc2b6c3d3fe7780dfd6aeb0a1b54","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:90cdcb21587cedc5bccac7d1f92e7100cdf7e6a0607a92e652da349cc88c67d1":{"type":"File","value":"90cdcb21587cedc5bccac7d1f92e7100cdf7e6a0607a92e652da349cc88c67d1","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:91de908c1f83004545a0fb33c61a6e4b0c1a8125bd5c003c19d42888cd0df604":{"type":"File","value":"91de908c1f83004545a0fb33c61a6e4b0c1a8125bd5c003c19d42888cd0df604","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:967e87a828056b934b50910649f5b1b8d4aedc4d841225c22eda68035b96fbd9":{"type":"File","value":"967e87a828056b934b50910649f5b1b8d4aedc4d841225c22eda68035b96fbd9","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:97f9656d2b44512074b7356b8af550748f4e6a74e450a044556bbe4037d9d239":{"type":"File","value":"97f9656d2b44512074b7356b8af550748f4e6a74e450a044556bbe4037d9d239","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 536x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:981eff45d5919fcfb8f56c485db115521a3ea947491a8d2c7ac252e7d19aeddb":{"type":"File","value":"981eff45d5919fcfb8f56c485db115521a3ea947491a8d2c7ac252e7d19aeddb","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:99de52f091ec0f3f3ef42869f76ffa8a18d0fee5dec00d63a3bbe5ba3ed444d0":{"type":"File","value":"99de52f091ec0f3f3ef42869f76ffa8a18d0fee5dec00d63a3bbe5ba3ed444d0","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:9a89524267d96d9ef3a57338f475c7a27ad07e6fef5ad1aecab50c2bf16d4b54":{"type":"File","value":"9a89524267d96d9ef3a57338f475c7a27ad07e6fef5ad1aecab50c2bf16d4b54","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:9d6a728b53f71a26fb7e8f519efd47dae0ce4acc6cbfc49709306bf01b9a3ca3":{"type":"File","value":"9d6a728b53f71a26fb7e8f519efd47dae0ce4acc6cbfc49709306bf01b9a3ca3","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:9f3fa4bd808f84f0cb559beabaf60d35f77cec248fa678aa9b1e5948e19856ac":{"type":"File","value":"9f3fa4bd808f84f0cb559beabaf60d35f77cec248fa678aa9b1e5948e19856ac","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:9f578771e7db1a718c232991dc0ed54fc981d618bab0299a65538193d30ac353":{"type":"File","value":"9f578771e7db1a718c232991dc0ed54fc981d618bab0299a65538193d30ac353","filetype":"HTML document, ASCII text","filetype_short":"HTML","mime_type":"application/javascript"},"File:a09d60060f7c204902e1ffea7883f34cca4efb2f6adce0035456c81c6aefe34b":{"type":"File","value":"a09d60060f7c204902e1ffea7883f34cca4efb2f6adce0035456c81c6aefe34b","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a142cf94b304d7cf44e3a2c16bca5856aa79c76722ef17f15a13ed0b9ff81c25":{"type":"File","value":"a142cf94b304d7cf44e3a2c16bca5856aa79c76722ef17f15a13ed0b9ff81c25","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a19766f42041ee81eec2d45a16bf681532781795456cf35323e8092b1c490459":{"type":"File","value":"a19766f42041ee81eec2d45a16bf681532781795456cf35323e8092b1c490459","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a30c4c39dc712c90cabbdaf0ca4444f1af64fbf77fb9aa11ae5b2faba4fbdcef":{"type":"File","value":"a30c4c39dc712c90cabbdaf0ca4444f1af64fbf77fb9aa11ae5b2faba4fbdcef","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a38978abd72ee39bb44cc2f913aced2db892a02065bb0cfe58ecfdbe2bb406b9":{"type":"File","value":"a38978abd72ee39bb44cc2f913aced2db892a02065bb0cfe58ecfdbe2bb406b9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 80 x 120 x 24, image size 28802, resolution 2834 x 2834 px/m, cbSize 28856, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:a45c88e28162ab57ab204ec3b31037d6bb949bb2ae3f1b5922bbc8559e2f1286":{"type":"File","value":"a45c88e28162ab57ab204ec3b31037d6bb949bb2ae3f1b5922bbc8559e2f1286","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9":{"type":"File","value":"a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 269 x 40 x 24, image size 32320, cbSize 32374, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:a594c3015e8f14ae24f610d5d0bc6b14abfce226478e4a25d8b5643af03eb9ab":{"type":"File","value":"a594c3015e8f14ae24f610d5d0bc6b14abfce226478e4a25d8b5643af03eb9ab","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294":{"type":"File","value":"a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:a728d1178b5f81dabc631efbcd4d6eacd260cf677b5772753b713af7af847cfd":{"type":"File","value":"a728d1178b5f81dabc631efbcd4d6eacd260cf677b5772753b713af7af847cfd","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 328 x 24, image size 527424, resolution 2834 x 2834 px/m, cbSize 527478, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:a87e4d326ab67083f75a95bc2c971a36560d98d80740e9b80567ce2e40b32957":{"type":"File","value":"a87e4d326ab67083f75a95bc2c971a36560d98d80740e9b80567ce2e40b32957","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:a93f8cb97e37aa935c3327ebdbc9b02c9c0ed8edba0df47e5edfe04b55fd0e92":{"type":"File","value":"a93f8cb97e37aa935c3327ebdbc9b02c9c0ed8edba0df47e5edfe04b55fd0e92","filetype":"Unicode text, UTF-8 text","filetype_short":"UTF8TEXT","mime_type":"text/plain"},"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93":{"type":"File","value":"ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:accc4d74044b8813d9c81bcaad45435e89ba2b6feb1a060dd75ac6448e273164":{"type":"File","value":"accc4d74044b8813d9c81bcaad45435e89ba2b6feb1a060dd75ac6448e273164","filetype":"Unicode text, UTF-16, little-endian text, with CRLF line terminators","mime_type":"text/plain"},"File:ae4ecf334d663ff20daf8ea43fd38814d7ac9a3600c91f1e789da244034e048e":{"type":"File","value":"ae4ecf334d663ff20daf8ea43fd38814d7ac9a3600c91f1e789da244034e048e","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:af3f119d4f646d08a73715212ff7a12ab47f09b6636fe99f389b991b5aba1eaa":{"type":"File","value":"af3f119d4f646d08a73715212ff7a12ab47f09b6636fe99f389b991b5aba1eaa","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:b201ebb2b7380e616427f1d119ca605f6dc03757a849a2be7a8c867ed1480996":{"type":"File","value":"b201ebb2b7380e616427f1d119ca605f6dc03757a849a2be7a8c867ed1480996","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:b3dca2911eb311e6de89e8846a20495fac2952d8daf8fd058baa9353b619491e":{"type":"File","value":"b3dca2911eb311e6de89e8846a20495fac2952d8daf8fd058baa9353b619491e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 233 x 6 x 24, image size 4200, cbSize 4254, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:b4baac0d6d929c69a140974445a914fbf10a73e2896082510d397b4abb2fa6a4":{"type":"File","value":"b4baac0d6d929c69a140974445a914fbf10a73e2896082510d397b4abb2fa6a4","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:b5884a6823818bffdb3d51af665d73282c8b7173aa3152cc2262b92bc2e3de5b":{"type":"File","value":"b5884a6823818bffdb3d51af665d73282c8b7173aa3152cc2262b92bc2e3de5b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 42 x 24, image size 67538, resolution 2834 x 2834 px/m, cbSize 67592, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104":{"type":"File","value":"b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:b9b38efc07aa594ae8b78cf405215516713b73db489893131a1101da3f37d1e2":{"type":"File","value":"b9b38efc07aa594ae8b78cf405215516713b73db489893131a1101da3f37d1e2","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 328 x 24, image size 527426, resolution 2834 x 2834 px/m, cbSize 527480, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:be40e33689bd3f6df14831dddafc6a67db6f0ab121ce993ff48486182bae98b6":{"type":"File","value":"be40e33689bd3f6df14831dddafc6a67db6f0ab121ce993ff48486182bae98b6","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:c172f76f3d5169b4cec9173ce1ac7b1284305f9089c8b26d0a732abbd0a53bd9":{"type":"File","value":"c172f76f3d5169b4cec9173ce1ac7b1284305f9089c8b26d0a732abbd0a53bd9","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c207312bbeb862f45c42888732447c05b33bc24d054732114e9c0b3aa3953a6a":{"type":"File","value":"c207312bbeb862f45c42888732447c05b33bc24d054732114e9c0b3aa3953a6a","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:c3459f81e28b4f2a024ada680842c0c3bee2e9c6fc48407fa5e463b83b10ae51":{"type":"File","value":"c3459f81e28b4f2a024ada680842c0c3bee2e9c6fc48407fa5e463b83b10ae51","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:c6a495586d4ab0661a2c26c9755bf99a9182b0ab9dbf2bb4702993756af2cf53":{"type":"File","value":"c6a495586d4ab0661a2c26c9755bf99a9182b0ab9dbf2bb4702993756af2cf53","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:c7875f1d27418030038c6df7d98f18e8b55b0d0191b30fcd8f207005ecb5e775":{"type":"File","value":"c7875f1d27418030038c6df7d98f18e8b55b0d0191b30fcd8f207005ecb5e775","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 37 x 25 x 24, image size 2802, resolution 2834 x 2834 px/m, cbSize 2856, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:ca2234ea194b5fc46ece3fdd964792e13e93b470c33f6a39b25cc482d38f6281":{"type":"File","value":"ca2234ea194b5fc46ece3fdd964792e13e93b470c33f6a39b25cc482d38f6281","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:cc413ca6f30625bca4f70beb7e9a8cd1cafe3d93553312f18559c2387ef29461":{"type":"File","value":"cc413ca6f30625bca4f70beb7e9a8cd1cafe3d93553312f18559c2387ef29461","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 328 x 24, image size 527426, resolution 2834 x 2834 px/m, cbSize 527480, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:cf4264d5b14edee1c5498086e8cba99b70e94db70317c94b750356efa0275362":{"type":"File","value":"cf4264d5b14edee1c5498086e8cba99b70e94db70317c94b750356efa0275362","filetype":"Unicode text, UTF-16, little-endian text, with CRLF line terminators","mime_type":"text/plain"},"File:d13dc351574b59f023519b3dd08297048e669be8f768919700028618cdeb8ec2":{"type":"File","value":"d13dc351574b59f023519b3dd08297048e669be8f768919700028618cdeb8ec2","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:d36b088a39e37d62b03bcd8e942ca2bbf53345fa7b4b1500e6d1748151f8ddbc":{"type":"File","value":"d36b088a39e37d62b03bcd8e942ca2bbf53345fa7b4b1500e6d1748151f8ddbc","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:d4c71d7c7c7488582eabe3eb2f1f169a469cb415aa6dc63752d82ef55a1ce44c":{"type":"File","value":"d4c71d7c7c7488582eabe3eb2f1f169a469cb415aa6dc63752d82ef55a1ce44c","filetype":"Composite Document File V2 Document, Cannot read section info","filetype_short":"CDF","mime_type":"image/vnd.ms-thumb"},"File:d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867":{"type":"File","value":"d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:d62addfb6711bbb968726d9e9ec2eb7e9b44f5cbe0695a30ba76209635181a10":{"type":"File","value":"d62addfb6711bbb968726d9e9ec2eb7e9b44f5cbe0695a30ba76209635181a10","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f":{"type":"File","value":"d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:d6f9e215c0b3f98affd76b4c81af655971e30a9bb458e909f4b2f42efbca9d4e":{"type":"File","value":"d6f9e215c0b3f98affd76b4c81af655971e30a9bb458e909f4b2f42efbca9d4e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 28 x 24, image size 45026, resolution 2834 x 2834 px/m, cbSize 45080, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:d9c2e150c4ea0e22b52f460036739e153b92e18992aaa9806e4511cebcc523f5":{"type":"File","value":"d9c2e150c4ea0e22b52f460036739e153b92e18992aaa9806e4511cebcc523f5","filetype":"Unicode text, UTF-8 text, with very long lines (363)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:dae37165be67fa447762e6abccba743f6363c053e6d0ead142973512f5b59746":{"type":"File","value":"dae37165be67fa447762e6abccba743f6363c053e6d0ead142973512f5b59746","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:db28a07950fcc3e6d44484954ce3c82f09f577a5e57d69bd4b935f3d0831a754":{"type":"File","value":"db28a07950fcc3e6d44484954ce3c82f09f577a5e57d69bd4b935f3d0831a754","filetype":"Unicode text, UTF-8 text, with very long lines (873)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f":{"type":"File","value":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:dc5eba2f818c2895e7f71ca2ff6a541bc077e1f200032426fa1a72ddf47d5dd4":{"type":"File","value":"dc5eba2f818c2895e7f71ca2ff6a541bc077e1f200032426fa1a72ddf47d5dd4","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 357 x 24, image size 574058, resolution 2834 x 2834 px/m, cbSize 574112, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:dddca8b65fbe098ac3fe9b5fe153012018f7d59dd4102c72989ccc0e053c6130":{"type":"File","value":"dddca8b65fbe098ac3fe9b5fe153012018f7d59dd4102c72989ccc0e053c6130","filetype":"Unicode text, UTF-8 text, with very long lines (535)","filetype_short":"UTF8TEXT","mime_type":"application/javascript"},"File:dfdbcc800a6bd3a2738c6041090081a07087ddebd14cf02792ac84a94d7c7541":{"type":"File","value":"dfdbcc800a6bd3a2738c6041090081a07087ddebd14cf02792ac84a94d7c7541","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:e20ffb186cf610c14c88dc7bdf49060d542617bfc2f6f7340620873da4f927d8":{"type":"File","value":"e20ffb186cf610c14c88dc7bdf49060d542617bfc2f6f7340620873da4f927d8","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a":{"type":"File","value":"e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e63601e5885482143574046082a023feaa2b8fae578a3b0ffb884d4e3c8bb13f":{"type":"File","value":"e63601e5885482143574046082a023feaa2b8fae578a3b0ffb884d4e3c8bb13f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 535x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:e86a4c7c266904a58a77a9f99283ad4b7d0118d9ea7c8ff016cff6fa4b6c8766":{"type":"File","value":"e86a4c7c266904a58a77a9f99283ad4b7d0118d9ea7c8ff016cff6fa4b6c8766","filetype":"PDF document, version 1.5, 15 page(s)","filetype_short":"PDF","mime_type":"application/pdf"},"File:e9c072cd0d658331583f2d44e26b266008c617c62132c9141ccb2e43feaead7c":{"type":"File","value":"e9c072cd0d658331583f2d44e26b266008c617c62132c9141ccb2e43feaead7c","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:eb1d1cbc5f2d00b53d66804c40ebc04d7338ffe2a9ff53b89b88876a0265a960":{"type":"File","value":"eb1d1cbc5f2d00b53d66804c40ebc04d7338ffe2a9ff53b89b88876a0265a960","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 536 x 328 x 24, image size 527426, resolution 2834 x 2834 px/m, cbSize 527480, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02":{"type":"File","value":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:ed9276f9aa9c1f2421514df8ee048ef312aedccb2f47a5b9dff56249df7721ee":{"type":"File","value":"ed9276f9aa9c1f2421514df8ee048ef312aedccb2f47a5b9dff56249df7721ee","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6":{"type":"File","value":"ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ef001213265cb736c04a3bfa1462896f648701f9b57b4a5cf4fc8ddc384db97e":{"type":"File","value":"ef001213265cb736c04a3bfa1462896f648701f9b57b4a5cf4fc8ddc384db97e","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:ef4be0f68c8ca2ea4434e9daf2b36e5443327a9b2a0fb8857c820183a757b9a4":{"type":"File","value":"ef4be0f68c8ca2ea4434e9daf2b36e5443327a9b2a0fb8857c820183a757b9a4","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f0f458b7e7f5e351a8d0a7daa450d7b8f31e56c7a614e960a1fb6d0690166451":{"type":"File","value":"f0f458b7e7f5e351a8d0a7daa450d7b8f31e56c7a614e960a1fb6d0690166451","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:f42710d71f69ab1571e811b0f19e1940e444bf818f2762cfe88dcdde7afa6163":{"type":"File","value":"f42710d71f69ab1571e811b0f19e1940e444bf818f2762cfe88dcdde7afa6163","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=328, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=535], baseline, precision 8, 536x328, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:f4fcc904e6890f08b43d4cb1130828bba23376a768899e121c78f016339f5bdb":{"type":"File","value":"f4fcc904e6890f08b43d4cb1130828bba23376a768899e121c78f016339f5bdb","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:f666881f19c1920a9283e1652a3d23f3c68a0bf70bc932b172f327f9e24ab949":{"type":"File","value":"f666881f19c1920a9283e1652a3d23f3c68a0bf70bc932b172f327f9e24ab949","filetype":"HTML document, Unicode text, UTF-8 text","filetype_short":"HTML","mime_type":"application/javascript"},"File:f6d8b7f6032a0c6ffe475e5563b0264059e471284a4077edba617d6a1f8790fe":{"type":"File","value":"f6d8b7f6032a0c6ffe475e5563b0264059e471284a4077edba617d6a1f8790fe","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:f7728ffd4fc3bbed24aed3bc774b16b9bfe9c652155ef0bd977208c452014b6e":{"type":"File","value":"f7728ffd4fc3bbed24aed3bc774b16b9bfe9c652155ef0bd977208c452014b6e","filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:ff86d75964f84a999f9193dd62e7f4f0eca18185d21e6e1322422c44299632ae":{"type":"File","value":"ff86d75964f84a999f9193dd62e7f4f0eca18185d21e6e1322422c44299632ae","filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"}},"chains":[{"id":"1562374014363475096","root":"File:0d307434e22558391a4a851b28366592cc54ffca943539bc78ca1aa8984cc0c9","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374014367669401","root":"File:108f514a38839ec5fd633d24ae869f4f212705a6ff46cfc27fe79622a5b30b77","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374014367669402","root":"File:15623c122bc63dfb29c5781f256cae2c049fbcb125823229719df986742b45b8","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374014376058013","root":"File:44475982c48ad449fdfc16b278ab4c31a4d481c1b4fb463777840d0974d3c308","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374014376058014","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:044632d6ddf430a721170ff037c702281f7df623267d9c38cfe06bd3e03bff58"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014384446623","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0bb072f8d39cdc1aa4a0844d1520874f260397809eea6d648155a4bc5cd9927c"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017307876608","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0c6aafc28cbdfeeca7412f377210e520f55de64cbe5c85d71528f0e16f51f36e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017328848131","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0fa6c61111f541d9742747b7c89cd1ee5622da5fdb48b4b258f4a8c76aebc9f1"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017358208264","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:13f558b0e5d992b39e5615254c90e05fde335285c2fa25a824b58108f5b475b8"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014388640928","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:140d81cab8ecb5bb2dc435ea0c159248199852f49ea551a07656a4607d4e6050"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014397029537","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:16f46cba85622c3fee5931056332b38fbedebf327466fa4a9e1cce36164e5a57"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014405418146","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:173e119c9dbc68d965058dca4c5deb56a0596de91edf96c8bff346d8dcc1db74"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014409612451","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:17bf96e421f3fb3531c5d5c3f93ec33f5691538b10c2729f518950bb8cc1d2dd"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017374985482","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:1cc0a36d4b3cabf92deb10c25aa3030ef3927ad15ece152696b72d74059e2b34"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014418001060","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:1f20c230c3d0c38f01503b7260ab4cbc31db2095e6fe0a38e7809050979deb4f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017387568396","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2220dda740ea76e8eb68cc7f45dcf66aec8c05e01a6824df3d7403e04878a707"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017433705746","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:23a75ac4695201df7eb0538a5fd1d9b600198b0471509373c5df69488ec0ba41"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014426389669","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2b2215a2f821dc568dbfa27e7d800df5fe0da6b9fbface93efc0d294571444c3"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014430583974","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2eceb6faa12c81d655cb3e809e8a76c83c6c1caba033ca3ae413fc390ad1059f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014438972583","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3281d8608e5857aaca50ba5071a6236f2dfc856229b452889c75fcf40103af2e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017467260183","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:35b3a42bf445b052aaef48ee881bf81698e5272d36c2d8432b118aff602bfdb7"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014447361192","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3b97604b24eb122f22c561bfbf8c6b816abbfa6fa78b7f5e5848561a4cbd4b7a"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014451555497","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3dfddd47ba94f1d31d4427fe981ab71a16979120318bfd955d2c3883656421b9"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014459944106","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3f65deb75ec7f44c881505b47d54401f9538a88cf447f5f40601b76cf30c84ad"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014464138411","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3fdafba4663a60b385315966ef64cb99999106e6cf8e86724ec9c7f296c1b698"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017479843097","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:40844872b38521586590b413c01bf5ee42abd6398cb65d7e8217ce90c6ea0bf7"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017488231706","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:40883639312b636129f99841aaddee60e3434a5647726a49d94ca98a04377c6e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017521786143","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:43e386ac435a84a3a332861c0df01556a9dcdbf448a3b263abba98f6085a21a0"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014472527020","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:44db922493e218abb12cab8a8a65f2e4f6441d251ebbd0ad793455b0fdb9d467"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014480915629","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4a00802a65d683c1176d616a6cd3761b3760341ecb8fc15d08c5c4210f56fb44"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014485109934","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4a10d95dfc1b713b91c6122a562fc9c616eda213088899b5c0c158c32362e92d"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017576312103","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4acd51c08998749081f5596eafc1064a209e751e2d3d070739ab1f2c2bdbc21f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017588895017","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4d73fd6b76097643c8df005e2464a116c0f7daa5daa89ea698baa3ec85ad98de"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014493498543","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4e026a9e955738d381db08e29e74edad36a70f4cda5a5c674be1147b3b875602"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017630838063","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4f1b097f5720f4f010eec0c656020b740766a3ad1aa2efc5d8844b0c9ccc1a9f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014501887152","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:51e72bb6b06f2b87cd6682b31f585c498664e46c26f8aab4229fa0ff5a022aad"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014506081457","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:523fbf9c903b35a107394fb91d120f8b9732b7c150b1b2eb57714d3921ab5dc8"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014514470066","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:52793ab7ef8f8e75d3ac37c18c98468fbb3ee2cb7345f4455912926280a9ac70"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017643420977","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:542c749b34eec28d9d8751a61b6451b56046fcddc8bcbd5a2c7ffbce254705d3"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014522858675","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:546eaad54da0041bd33ea35c609ca835ed71908d584ea7bef50ec70e93d708da"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014531247284","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:595fb3c20262041b53bd2557011a40179f607c078a0076b783248018bcdf4c36"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017689558328","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:5c5f0f73d4f26bd211581125d1f8d0e07e5dee3d39cb88568e56cdc6d631df03"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014535441589","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:60b3d23ef2cb8378682d402506b19cd849384858df0a09ccf7b18b22394ad663"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014543830198","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:6dcbd877fb10f004f0bb0508ca1dd6950e26245328f1910fe1baeb4b3ef4aba7"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014552218807","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:6f402cbd0c226691088af597372776a111f718cd1abf8b2d2fa7837097e6cce2"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014560607416","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:71fac56a7186a41158be253d7665209e3bb29d314a77cbaa4d1a83f51bee7cc8"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014564801721","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7416244a54047b76eb738f2086fba0b67555d6d67910fcc0502209d1fa100618"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014573190330","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:744d7088c68a966552107bc2a4b8a1c03650add1bc011b5dcb7a2815288898c3"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017811193161","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:75cef7ef141fbbdd40980161bb7f451bbe19dbd6bef8d015cf8d5100c8b06d20"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014581578939","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:76aac6cb857cff28ccbc1f54fe596e6e722b39e7f76a2bd30985de36b48e0691"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014585773244","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7b52572496fa44d8bab5c1c815d9c6eeaaf59479a2c2a93be898e48d0701cb79"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014594161853","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7c36f47a2c8620a856744215635c718edc0d7972fd0d02c0a8bf805337a1dca3"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014602550462","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7e866217e8638f93fa63e554a1845e92eb4f835a6f692bec783206edcd9e8649"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014610939071","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7fd44a9a619400de5d7e09caed4252ce29607b05c1fc16de17f621422c1e1673"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017853136207","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:801f5c50e8e4eb2e1b59c5ee4bcea351a23214b71f6b28fb8ba53642dbceedd2"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014615133376","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:827a70e802ab513277a574bd791ff28b85a0c29e86722c7f4df61dcaaaae05c0"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014623521985","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:8717f2d18e86a315edd8077780c138af9aed72b336b499346f830a0ba9fcdfed"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017869913425","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:87e3d87b50fd24ee240bf0c49a1df279d568c4de0f89245bdeb3ba39a0d51cc1"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017895079253","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:87e4f549665a4cbb8c4455a9eed07318d149f5ea684394b507170df7ff03f125"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014631910594","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:8a70cea5b779456fd0109bd43a5cc6359ea4cc2b6c3d3fe7780dfd6aeb0a1b54"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017924439385","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:90cdcb21587cedc5bccac7d1f92e7100cdf7e6a0607a92e652da349cc88c67d1"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017937022299","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:91de908c1f83004545a0fb33c61a6e4b0c1a8125bd5c003c19d42888cd0df604"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014640299203","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:967e87a828056b934b50910649f5b1b8d4aedc4d841225c22eda68035b96fbd9"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014648687812","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:981eff45d5919fcfb8f56c485db115521a3ea947491a8d2c7ac252e7d19aeddb"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014652882117","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:99de52f091ec0f3f3ef42869f76ffa8a18d0fee5dec00d63a3bbe5ba3ed444d0"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017949605213","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9d6a728b53f71a26fb7e8f519efd47dae0ce4acc6cbfc49709306bf01b9a3ca3"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014661270726","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9f3fa4bd808f84f0cb559beabaf60d35f77cec248fa678aa9b1e5948e19856ac"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014669659335","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9f578771e7db1a718c232991dc0ed54fc981d618bab0299a65538193d30ac353"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014673853640","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a09d60060f7c204902e1ffea7883f34cca4efb2f6adce0035456c81c6aefe34b"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014678047945","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a142cf94b304d7cf44e3a2c16bca5856aa79c76722ef17f15a13ed0b9ff81c25"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014686436554","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a19766f42041ee81eec2d45a16bf681532781795456cf35323e8092b1c490459"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014690630859","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a30c4c39dc712c90cabbdaf0ca4444f1af64fbf77fb9aa11ae5b2faba4fbdcef"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014694825164","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a45c88e28162ab57ab204ec3b31037d6bb949bb2ae3f1b5922bbc8559e2f1286"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014699019469","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a594c3015e8f14ae24f610d5d0bc6b14abfce226478e4a25d8b5643af03eb9ab"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014703213774","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a87e4d326ab67083f75a95bc2c971a36560d98d80740e9b80567ce2e40b32957"}],"verdict":{"verdict":"unknown"}},{"id":"1562374017991548254","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014711602383","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ae4ecf334d663ff20daf8ea43fd38814d7ac9a3600c91f1e789da244034e048e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014715796688","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:af3f119d4f646d08a73715212ff7a12ab47f09b6636fe99f389b991b5aba1eaa"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018352258401","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b201ebb2b7380e616427f1d119ca605f6dc03757a849a2be7a8c867ed1480996"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014719990993","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b4baac0d6d929c69a140974445a914fbf10a73e2896082510d397b4abb2fa6a4"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018431950188","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:be40e33689bd3f6df14831dddafc6a67db6f0ab121ce993ff48486182bae98b6"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014724185298","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c172f76f3d5169b4cec9173ce1ac7b1284305f9089c8b26d0a732abbd0a53bd9"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014732573907","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c207312bbeb862f45c42888732447c05b33bc24d054732114e9c0b3aa3953a6a"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014736768212","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c3459f81e28b4f2a024ada680842c0c3bee2e9c6fc48407fa5e463b83b10ae51"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014745156821","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c6a495586d4ab0661a2c26c9755bf99a9182b0ab9dbf2bb4702993756af2cf53"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014749351126","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ca2234ea194b5fc46ece3fdd964792e13e93b470c33f6a39b25cc482d38f6281"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018457116016","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d13dc351574b59f023519b3dd08297048e669be8f768919700028618cdeb8ec2"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014753545431","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d62addfb6711bbb968726d9e9ec2eb7e9b44f5cbe0695a30ba76209635181a10"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018490670453","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d9c2e150c4ea0e22b52f460036739e153b92e18992aaa9806e4511cebcc523f5"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014761934040","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dae37165be67fa447762e6abccba743f6363c053e6d0ead142973512f5b59746"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018528419194","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:db28a07950fcc3e6d44484954ce3c82f09f577a5e57d69bd4b935f3d0831a754"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018561973631","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dddca8b65fbe098ac3fe9b5fe153012018f7d59dd4102c72989ccc0e053c6130"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014766128345","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dfdbcc800a6bd3a2738c6041090081a07087ddebd14cf02792ac84a94d7c7541"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014770322650","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e20ffb186cf610c14c88dc7bdf49060d542617bfc2f6f7340620873da4f927d8"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014778711259","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e86a4c7c266904a58a77a9f99283ad4b7d0118d9ea7c8ff016cff6fa4b6c8766"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014782905564","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e9c072cd0d658331583f2d44e26b266008c617c62132c9141ccb2e43feaead7c"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014787099869","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ed9276f9aa9c1f2421514df8ee048ef312aedccb2f47a5b9dff56249df7721ee"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018578750850","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ef001213265cb736c04a3bfa1462896f648701f9b57b4a5cf4fc8ddc384db97e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018587139460","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f0f458b7e7f5e351a8d0a7daa450d7b8f31e56c7a614e960a1fb6d0690166451"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014791294174","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f4fcc904e6890f08b43d4cb1130828bba23376a768899e121c78f016339f5bdb"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014799682783","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f666881f19c1920a9283e1652a3d23f3c68a0bf70bc932b172f327f9e24ab949"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014803877088","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f6d8b7f6032a0c6ffe475e5563b0264059e471284a4077edba617d6a1f8790fe"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014808071393","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f7728ffd4fc3bbed24aed3bc774b16b9bfe9c652155ef0bd977208c452014b6e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014812265698","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ff86d75964f84a999f9193dd62e7f4f0eca18185d21e6e1322422c44299632ae"}],"verdict":{"verdict":"unknown"}},{"id":"1562373980001553107","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:0b335d6c819bda2640fca034bf370850455a396195e119a2dd2f57a83bb5c7aa"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015676292323","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374007313292484","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:1e918b00ded2e2bdd568b78bfd3b51f33fb17b1645356c790d15b8caa354e8bc"}],"verdict":{"verdict":"unknown"}},{"id":"1562373979993164440","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:31f0ce1506413284c1b5efe279478c0fe9dceba110b000446aff21beef9355d6"}],"verdict":{"verdict":"unknown"}},{"id":"1562374014371863707","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:32ed02d0cd57b4dbf545e187e85d32e60453a74c21fce0b6fb1b975daba94cea"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015714041060","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:41965757945dae3a01a12571fddefe8c35d105d6f88e8d9add205bdd170e8232"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374014371863708","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015726623973","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:49d5368f3b0bc0aee9d9fca3564463bc3e80bc1811f4492a0abd4577f6f2ed47"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015743401190","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015755984103","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015776955624","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:551adc4d7ed627746cf1213ac49ebe80c798bfdf825f53a6eab21395314c607e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015793732841","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015806315754","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:5cffe1ec979622a55cada9b9c191df476a887c6f0c4a7046382cd0f8848c9743"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374018654248333","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:6344b8057288701c7d78b0d2d205b82af40eec86f718d3dfbfd5f0dc1b101ca7"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007313292492","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:7d936aebee57e04338308ed8c52ce2c24e21b2978721326be3eb9e90c080834e"}],"verdict":{"verdict":"unknown"}},{"id":"1562374016750034169","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:86818fedfc2bd0a2760049e5cb1223b065bb8e618a7a0635ce59bb7ba34a8c65"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007309098175","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015877618923","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:97f9656d2b44512074b7356b8af550748f4e6a74e450a044556bbe4037d9d239"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015894396140","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:9a89524267d96d9ef3a57338f475c7a27ad07e6fef5ad1aecab50c2bf16d4b54"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015911173357","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:a38978abd72ee39bb44cc2f913aced2db892a02065bb0cfe58ecfdbe2bb406b9"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015923756270","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007325875443","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015948922095","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:a728d1178b5f81dabc631efbcd4d6eacd260cf677b5772753b713af7af847cfd"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015965699312","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:a93f8cb97e37aa935c3327ebdbc9b02c9c0ed8edba0df47e5edfe04b55fd0e92"}],"verdict":{"verdict":"unknown"}},{"id":"1562374018662636942","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:accc4d74044b8813d9c81bcaad45435e89ba2b6feb1a060dd75ac6448e273164"}],"verdict":{"verdict":"unknown"}},{"id":"1562374015978282225","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:b3dca2911eb311e6de89e8846a20495fac2952d8daf8fd058baa9353b619491e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374015995059442","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:b5884a6823818bffdb3d51af665d73282c8b7173aa3152cc2262b92bc2e3de5b"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016011836659","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016758422779","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:c7875f1d27418030038c6df7d98f18e8b55b0d0191b30fcd8f207005ecb5e775"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016024419572","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:cc413ca6f30625bca4f70beb7e9a8cd1cafe3d93553312f18559c2387ef29461"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007321681131","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:cf4264d5b14edee1c5498086e8cba99b70e94db70317c94b750356efa0275362"}],"verdict":{"verdict":"unknown"}},{"id":"1562374007321681134","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:d36b088a39e37d62b03bcd8e942ca2bbf53345fa7b4b1500e6d1748151f8ddbc"}],"verdict":{"verdict":"unknown"}},{"id":"1562373988541489317","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:d4c71d7c7c7488582eabe3eb2f1f169a469cb415aa6dc63752d82ef55a1ce44c"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016771005692","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007317486813","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374007330069771","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f"}],"verdict":{"verdict":"unknown"}},{"id":"1562374016083139829","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:dc5eba2f818c2895e7f71ca2ff6a541bc077e1f200032426fa1a72ddf47d5dd4"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007321681125","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a"}],"verdict":{"verdict":"unknown"}},{"id":"1562374016800365822","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:e63601e5885482143574046082a023feaa2b8fae578a3b0ffb884d4e3c8bb13f"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016108305654","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:eb1d1cbc5f2d00b53d66804c40ebc04d7338ffe2a9ff53b89b88876a0265a960"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374007334264097","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"}],"verdict":{"verdict":"unknown"}},{"id":"1562374016141860087","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6"}],"verdict":{"verdict":"unknown"}},{"id":"1562373979988970119","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:ef4be0f68c8ca2ea4434e9daf2b36e5443327a9b2a0fb8857c820183a757b9a4"}],"verdict":{"verdict":"unknown"}},{"id":"1562374016158637304","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted_from_archive","from_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","to_key":"File:f42710d71f69ab1571e811b0f19e1940e444bf818f2762cfe88dcdde7afa6163"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016758422778","root":"File:b9b38efc07aa594ae8b78cf405215516713b73db489893131a1101da3f37d1e2","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1562374016775199997","root":"File:d6f9e215c0b3f98affd76b4c81af655971e30a9bb458e909f4b2f42efbca9d4e","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"sandbox_files","root":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","edges":[{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:cf4264d5b14edee1c5498086e8cba99b70e94db70317c94b750356efa0275362"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f4fcc904e6890f08b43d4cb1130828bba23376a768899e121c78f016339f5bdb"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c172f76f3d5169b4cec9173ce1ac7b1284305f9089c8b26d0a732abbd0a53bd9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4a10d95dfc1b713b91c6122a562fc9c616eda213088899b5c0c158c32362e92d"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7b52572496fa44d8bab5c1c815d9c6eeaaf59479a2c2a93be898e48d0701cb79"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ca2234ea194b5fc46ece3fdd964792e13e93b470c33f6a39b25cc482d38f6281"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f0f458b7e7f5e351a8d0a7daa450d7b8f31e56c7a614e960a1fb6d0690166451"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e20ffb186cf610c14c88dc7bdf49060d542617bfc2f6f7340620873da4f927d8"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:981eff45d5919fcfb8f56c485db115521a3ea947491a8d2c7ac252e7d19aeddb"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f666881f19c1920a9283e1652a3d23f3c68a0bf70bc932b172f327f9e24ab949"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ae4ecf334d663ff20daf8ea43fd38814d7ac9a3600c91f1e789da244034e048e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9f3fa4bd808f84f0cb559beabaf60d35f77cec248fa678aa9b1e5948e19856ac"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a45c88e28162ab57ab204ec3b31037d6bb949bb2ae3f1b5922bbc8559e2f1286"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:87e3d87b50fd24ee240bf0c49a1df279d568c4de0f89245bdeb3ba39a0d51cc1"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:801f5c50e8e4eb2e1b59c5ee4bcea351a23214b71f6b28fb8ba53642dbceedd2"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b3dca2911eb311e6de89e8846a20495fac2952d8daf8fd058baa9353b619491e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e63601e5885482143574046082a023feaa2b8fae578a3b0ffb884d4e3c8bb13f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4f1b097f5720f4f010eec0c656020b740766a3ad1aa2efc5d8844b0c9ccc1a9f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:6f402cbd0c226691088af597372776a111f718cd1abf8b2d2fa7837097e6cce2"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:17bf96e421f3fb3531c5d5c3f93ec33f5691538b10c2729f518950bb8cc1d2dd"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:35b3a42bf445b052aaef48ee881bf81698e5272d36c2d8432b118aff602bfdb7"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:5c5f0f73d4f26bd211581125d1f8d0e07e5dee3d39cb88568e56cdc6d631df03"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3f65deb75ec7f44c881505b47d54401f9538a88cf447f5f40601b76cf30c84ad"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:32ed02d0cd57b4dbf545e187e85d32e60453a74c21fce0b6fb1b975daba94cea"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ff86d75964f84a999f9193dd62e7f4f0eca18185d21e6e1322422c44299632ae"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a38978abd72ee39bb44cc2f913aced2db892a02065bb0cfe58ecfdbe2bb406b9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f42710d71f69ab1571e811b0f19e1940e444bf818f2762cfe88dcdde7afa6163"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3fdafba4663a60b385315966ef64cb99999106e6cf8e86724ec9c7f296c1b698"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7e866217e8638f93fa63e554a1845e92eb4f835a6f692bec783206edcd9e8649"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:13f558b0e5d992b39e5615254c90e05fde335285c2fa25a824b58108f5b475b8"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:49d5368f3b0bc0aee9d9fca3564463bc3e80bc1811f4492a0abd4577f6f2ed47"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c7875f1d27418030038c6df7d98f18e8b55b0d0191b30fcd8f207005ecb5e775"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:523fbf9c903b35a107394fb91d120f8b9732b7c150b1b2eb57714d3921ab5dc8"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:eb1d1cbc5f2d00b53d66804c40ebc04d7338ffe2a9ff53b89b88876a0265a960"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d9c2e150c4ea0e22b52f460036739e153b92e18992aaa9806e4511cebcc523f5"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d62addfb6711bbb968726d9e9ec2eb7e9b44f5cbe0695a30ba76209635181a10"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:af3f119d4f646d08a73715212ff7a12ab47f09b6636fe99f389b991b5aba1eaa"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9f578771e7db1a718c232991dc0ed54fc981d618bab0299a65538193d30ac353"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:1f20c230c3d0c38f01503b7260ab4cbc31db2095e6fe0a38e7809050979deb4f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:43e386ac435a84a3a332861c0df01556a9dcdbf448a3b263abba98f6085a21a0"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:827a70e802ab513277a574bd791ff28b85a0c29e86722c7f4df61dcaaaae05c0"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:87e4f549665a4cbb8c4455a9eed07318d149f5ea684394b507170df7ff03f125"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4acd51c08998749081f5596eafc1064a209e751e2d3d070739ab1f2c2bdbc21f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dfdbcc800a6bd3a2738c6041090081a07087ddebd14cf02792ac84a94d7c7541"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a09d60060f7c204902e1ffea7883f34cca4efb2f6adce0035456c81c6aefe34b"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b4baac0d6d929c69a140974445a914fbf10a73e2896082510d397b4abb2fa6a4"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d4c71d7c7c7488582eabe3eb2f1f169a469cb415aa6dc63752d82ef55a1ce44c"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:71fac56a7186a41158be253d7665209e3bb29d314a77cbaa4d1a83f51bee7cc8"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:40844872b38521586590b413c01bf5ee42abd6398cb65d7e8217ce90c6ea0bf7"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:967e87a828056b934b50910649f5b1b8d4aedc4d841225c22eda68035b96fbd9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dddca8b65fbe098ac3fe9b5fe153012018f7d59dd4102c72989ccc0e053c6130"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ef4be0f68c8ca2ea4434e9daf2b36e5443327a9b2a0fb8857c820183a757b9a4"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:595fb3c20262041b53bd2557011a40179f607c078a0076b783248018bcdf4c36"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:41965757945dae3a01a12571fddefe8c35d105d6f88e8d9add205bdd170e8232"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c3459f81e28b4f2a024ada680842c0c3bee2e9c6fc48407fa5e463b83b10ae51"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:542c749b34eec28d9d8751a61b6451b56046fcddc8bcbd5a2c7ffbce254705d3"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:cc413ca6f30625bca4f70beb7e9a8cd1cafe3d93553312f18559c2387ef29461"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:546eaad54da0041bd33ea35c609ca835ed71908d584ea7bef50ec70e93d708da"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d13dc351574b59f023519b3dd08297048e669be8f768919700028618cdeb8ec2"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4e026a9e955738d381db08e29e74edad36a70f4cda5a5c674be1147b3b875602"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ed9276f9aa9c1f2421514df8ee048ef312aedccb2f47a5b9dff56249df7721ee"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a142cf94b304d7cf44e3a2c16bca5856aa79c76722ef17f15a13ed0b9ff81c25"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c6a495586d4ab0661a2c26c9755bf99a9182b0ab9dbf2bb4702993756af2cf53"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:1e918b00ded2e2bdd568b78bfd3b51f33fb17b1645356c790d15b8caa354e8bc"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:173e119c9dbc68d965058dca4c5deb56a0596de91edf96c8bff346d8dcc1db74"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0c6aafc28cbdfeeca7412f377210e520f55de64cbe5c85d71528f0e16f51f36e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:23a75ac4695201df7eb0538a5fd1d9b600198b0471509373c5df69488ec0ba41"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:40883639312b636129f99841aaddee60e3434a5647726a49d94ca98a04377c6e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a30c4c39dc712c90cabbdaf0ca4444f1af64fbf77fb9aa11ae5b2faba4fbdcef"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:6dcbd877fb10f004f0bb0508ca1dd6950e26245328f1910fe1baeb4b3ef4aba7"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d36b088a39e37d62b03bcd8e942ca2bbf53345fa7b4b1500e6d1748151f8ddbc"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4a00802a65d683c1176d616a6cd3761b3760341ecb8fc15d08c5c4210f56fb44"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:8717f2d18e86a315edd8077780c138af9aed72b336b499346f830a0ba9fcdfed"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e9c072cd0d658331583f2d44e26b266008c617c62132c9141ccb2e43feaead7c"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0fa6c61111f541d9742747b7c89cd1ee5622da5fdb48b4b258f4a8c76aebc9f1"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3b97604b24eb122f22c561bfbf8c6b816abbfa6fa78b7f5e5848561a4cbd4b7a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dc5eba2f818c2895e7f71ca2ff6a541bc077e1f200032426fa1a72ddf47d5dd4"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7c36f47a2c8620a856744215635c718edc0d7972fd0d02c0a8bf805337a1dca3"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a87e4d326ab67083f75a95bc2c971a36560d98d80740e9b80567ce2e40b32957"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:31f0ce1506413284c1b5efe279478c0fe9dceba110b000446aff21beef9355d6"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:5cffe1ec979622a55cada9b9c191df476a887c6f0c4a7046382cd0f8848c9743"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:6344b8057288701c7d78b0d2d205b82af40eec86f718d3dfbfd5f0dc1b101ca7"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2b2215a2f821dc568dbfa27e7d800df5fe0da6b9fbface93efc0d294571444c3"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7fd44a9a619400de5d7e09caed4252ce29607b05c1fc16de17f621422c1e1673"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0b335d6c819bda2640fca034bf370850455a396195e119a2dd2f57a83bb5c7aa"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:551adc4d7ed627746cf1213ac49ebe80c798bfdf825f53a6eab21395314c607e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:90cdcb21587cedc5bccac7d1f92e7100cdf7e6a0607a92e652da349cc88c67d1"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7416244a54047b76eb738f2086fba0b67555d6d67910fcc0502209d1fa100618"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a93f8cb97e37aa935c3327ebdbc9b02c9c0ed8edba0df47e5edfe04b55fd0e92"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2eceb6faa12c81d655cb3e809e8a76c83c6c1caba033ca3ae413fc390ad1059f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:1cc0a36d4b3cabf92deb10c25aa3030ef3927ad15ece152696b72d74059e2b34"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f7728ffd4fc3bbed24aed3bc774b16b9bfe9c652155ef0bd977208c452014b6e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9a89524267d96d9ef3a57338f475c7a27ad07e6fef5ad1aecab50c2bf16d4b54"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:2220dda740ea76e8eb68cc7f45dcf66aec8c05e01a6824df3d7403e04878a707"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:52793ab7ef8f8e75d3ac37c18c98468fbb3ee2cb7345f4455912926280a9ac70"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:7d936aebee57e04338308ed8c52ce2c24e21b2978721326be3eb9e90c080834e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3281d8608e5857aaca50ba5071a6236f2dfc856229b452889c75fcf40103af2e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:75cef7ef141fbbdd40980161bb7f451bbe19dbd6bef8d015cf8d5100c8b06d20"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:91de908c1f83004545a0fb33c61a6e4b0c1a8125bd5c003c19d42888cd0df604"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:accc4d74044b8813d9c81bcaad45435e89ba2b6feb1a060dd75ac6448e273164"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b201ebb2b7380e616427f1d119ca605f6dc03757a849a2be7a8c867ed1480996"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:44db922493e218abb12cab8a8a65f2e4f6441d251ebbd0ad793455b0fdb9d467"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:db28a07950fcc3e6d44484954ce3c82f09f577a5e57d69bd4b935f3d0831a754"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:044632d6ddf430a721170ff037c702281f7df623267d9c38cfe06bd3e03bff58"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:140d81cab8ecb5bb2dc435ea0c159248199852f49ea551a07656a4607d4e6050"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:f6d8b7f6032a0c6ffe475e5563b0264059e471284a4077edba617d6a1f8790fe"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:86818fedfc2bd0a2760049e5cb1223b065bb8e618a7a0635ce59bb7ba34a8c65"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4d73fd6b76097643c8df005e2464a116c0f7daa5daa89ea698baa3ec85ad98de"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:97f9656d2b44512074b7356b8af550748f4e6a74e450a044556bbe4037d9d239"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a594c3015e8f14ae24f610d5d0bc6b14abfce226478e4a25d8b5643af03eb9ab"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:60b3d23ef2cb8378682d402506b19cd849384858df0a09ccf7b18b22394ad663"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a728d1178b5f81dabc631efbcd4d6eacd260cf677b5772753b713af7af847cfd"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:3dfddd47ba94f1d31d4427fe981ab71a16979120318bfd955d2c3883656421b9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:99de52f091ec0f3f3ef42869f76ffa8a18d0fee5dec00d63a3bbe5ba3ed444d0"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a19766f42041ee81eec2d45a16bf681532781795456cf35323e8092b1c490459"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dae37165be67fa447762e6abccba743f6363c053e6d0ead142973512f5b59746"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:76aac6cb857cff28ccbc1f54fe596e6e722b39e7f76a2bd30985de36b48e0691"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:be40e33689bd3f6df14831dddafc6a67db6f0ab121ce993ff48486182bae98b6"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e86a4c7c266904a58a77a9f99283ad4b7d0118d9ea7c8ff016cff6fa4b6c8766"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:744d7088c68a966552107bc2a4b8a1c03650add1bc011b5dcb7a2815288898c3"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:c207312bbeb862f45c42888732447c05b33bc24d054732114e9c0b3aa3953a6a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:8a70cea5b779456fd0109bd43a5cc6359ea4cc2b6c3d3fe7780dfd6aeb0a1b54"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:9d6a728b53f71a26fb7e8f519efd47dae0ce4acc6cbfc49709306bf01b9a3ca3"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b5884a6823818bffdb3d51af665d73282c8b7173aa3152cc2262b92bc2e3de5b"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:16f46cba85622c3fee5931056332b38fbedebf327466fa4a9e1cce36164e5a57"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ef001213265cb736c04a3bfa1462896f648701f9b57b4a5cf4fc8ddc384db97e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0bb072f8d39cdc1aa4a0844d1520874f260397809eea6d648155a4bc5cd9927c"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:51e72bb6b06f2b87cd6682b31f585c498664e46c26f8aab4229fa0ff5a022aad"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0d307434e22558391a4a851b28366592cc54ffca943539bc78ca1aa8984cc0c9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:d6f9e215c0b3f98affd76b4c81af655971e30a9bb458e909f4b2f42efbca9d4e"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:097c218e38b7aa560b3ab75c2175458bcb1fff19abb27a03bd18fecc8767a858"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:0c66e4dfe9e05c318cbb2fef0c4e7fb7efa1210f218e4141d5d4f5648ce9adc4"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"},{"edge_kind":"extracted","from_key":"File:8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","to_key":"File:ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":165,"files_written_count":54,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ad86ff276507a2cc1028d0e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe","analysis_start_time":"2026-10-21T07:55:34+00:00","indicators_count":{"informative":134,"suspicious":16,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}],"processes":[{"pid":5652,"ppid":0,"name":"General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe","command_line":"","sha256":"8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979","normalized_path":"C:\\General_DiskManager_Eng_WIN32_V2.02.1.R.170417.exe","uid":"00000000-00005652","icon":"$45"}],"all_imported_dlls":["imm32.dll","SHCore.dll","psapi.dll","CoreUIComponents.dll","gdi32full.dll","wow64cpu.dll","vcruntime140.dll","shlwapi.dll","KernelBase.dll","ole32.dll","cryptbase.dll","TestDLL.dll","uxtheme.dll","cfgmgr32.dll","clbcatq.dll","fltLib.dll","gdi32.dll","wow64con.dll","msimg32.dll","wow64.dll","sechost.dll","riched20.dll","msvcrt.dll","combase.dll","msvcp140.dll","kernel.appcore.dll","TextShaping.dll","win32u.dll","shfolder.dll","SkinBtn.dll","ButtonEvent.dll","shell32.dll","rpcrt4.dll","version.dll","user32.dll","wow64base.dll","cryptsp.dll","usp10.dll","oleaut32.dll","msctf.dll","msvcp_win.dll","VxSSL32.dll","bcryptprimitives.dll","msls31.dll","System.dll","comdlg32.dll","CoreMessaging.dll","wow64win.dll","kernel32.dll","apphelp.dll","TextInputFramework.dll","advapi32.dll","ws2_32.dll","windows.storage.dll","WinTypes.dll","nsDialogs.dll","ntdll.dll","ucrtbase.dll","comctl32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"$$PLUGINSDIR/nsExec.dll","sha256":"168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/FindProcDLL.dll","sha256":"a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/Slides.dat","sha256":"cf4264d5b14edee1c5498086e8cba99b70e94db70317c94b750356efa0275362","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Strategy/BBOX.js","sha256":"f4fcc904e6890f08b43d4cb1130828bba23376a768899e121c78f016339f5bdb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"DiskManager.exe","sha256":"c172f76f3d5169b4cec9173ce1ac7b1284305f9089c8b26d0a732abbd0a53bd9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/ProgressBar.bmp","sha256":"57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Google.js","sha256":"4a10d95dfc1b713b91c6122a562fc9c616eda213088899b5c0c158c32362e92d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Style.js","sha256":"7b52572496fa44d8bab5c1c815d9c6eeaaf59479a2c2a93be898e48d0701cb79","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format.js","sha256":"ca2234ea194b5fc46ece3fdd964792e13e93b470c33f6a39b25cc482d38f6281","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/Rico/Corner.js","sha256":"f0f458b7e7f5e351a8d0a7daa450d7b8f31e56c7a614e960a1fb6d0690166451","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Protocol.js","sha256":"e20ffb186cf610c14c88dc7bdf49060d542617bfc2f6f7340620873da4f927d8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Feature.js","sha256":"981eff45d5919fcfb8f56c485db115521a3ea947491a8d2c7ac252e7d19aeddb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/nb.js","sha256":"f666881f19c1920a9283e1652a3d23f3c68a0bf70bc932b172f327f9e24ab949","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/StyleMap.js","sha256":"ae4ecf334d663ff20daf8ea43fd38814d7ac9a3600c91f1e789da244034e048e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Path.js","sha256":"9f3fa4bd808f84f0cb559beabaf60d35f77cec248fa678aa9b1e5948e19856ac","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Hover.js","sha256":"a45c88e28162ab57ab204ec3b31037d6bb949bb2ae3f1b5922bbc8559e2f1286","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"uninst.exe","sha256":"ac71c0d4e930e37d580d922ad0f5da343f71d08fda3dea54b8d5f3ccfeaa0d93","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Tween.js","sha256":"87e3d87b50fd24ee240bf0c49a1df279d568c4de0f89245bdeb3ba39a0d51cc1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/GeoRSS.js","sha256":"801f5c50e8e4eb2e1b59c5ee4bcea351a23214b71f6b28fb8ba53642dbceedd2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/bottom1.bmp","sha256":"b3dca2911eb311e6de89e8846a20495fac2952d8daf8fd058baa9353b619491e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�½��ļ��/Slide 021.jpg","sha256":"e63601e5885482143574046082a023feaa2b8fae578a3b0ffb884d4e3c8bb13f","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Renderer/SVG.js","sha256":"4f1b097f5720f4f010eec0c656020b740766a3ad1aa2efc5d8844b0c9ccc1a9f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Request.js","sha256":"6f402cbd0c226691088af597372776a111f718cd1abf8b2d2fa7837097e6cce2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/WPSClient.js","sha256":"17bf96e421f3fb3531c5d5c3f93ec33f5691538b10c2729f518950bb8cc1d2dd","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/pt-BR.js","sha256":"35b3a42bf445b052aaef48ee881bf81698e5272d36c2d8432b118aff602bfdb7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/TMS.js","sha256":"5c5f0f73d4f26bd211581125d1f8d0e07e5dee3d39cb88568e56cdc6d631df03","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/JSON.js","sha256":"3f65deb75ec7f44c881505b47d54401f9538a88cf447f5f40601b76cf30c84ad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�½��ļ��/Slide 02.jpg","sha256":"32ed02d0cd57b4dbf545e187e85d32e60453a74c21fce0b6fb1b975daba94cea","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/WPSProcess.js","sha256":"ff86d75964f84a999f9193dd62e7f4f0eca18185d21e6e1322422c44299632ae","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/button1.bmp","sha256":"a38978abd72ee39bb44cc2f913aced2db892a02065bb0cfe58ecfdbe2bb406b9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/old.jpg","sha256":"f42710d71f69ab1571e811b0f19e1940e444bf818f2762cfe88dcdde7afa6163","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Image.js","sha256":"3fdafba4663a60b385315966ef64cb99999106e6cf8e86724ec9c7f296c1b698","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/pl.js","sha256":"7e866217e8638f93fa63e554a1845e92eb4f835a6f692bec783206edcd9e8649","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/de.js","sha256":"13f558b0e5d992b39e5615254c90e05fde335285c2fa25a824b58108f5b475b8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/Slide 02.jpg","sha256":"49d5368f3b0bc0aee9d9fca3564463bc3e80bc1811f4492a0abd4577f6f2ed47","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/close.bmp","sha256":"c7875f1d27418030038c6df7d98f18e8b55b0d0191b30fcd8f207005ecb5e775","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Popup/Framed.js","sha256":"523fbf9c903b35a107394fb91d120f8b9732b7c150b1b2eb57714d3921ab5dc8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/Header1.bmp","sha256":"4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/finish.bmp","sha256":"eb1d1cbc5f2d00b53d66804c40ebc04d7338ffe2a9ff53b89b88876a0265a960","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/ja.js","sha256":"d9c2e150c4ea0e22b52f460036739e153b92e18992aaa9806e4511cebcc523f5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/WKT.js","sha256":"d62addfb6711bbb968726d9e9ec2eb7e9b44f5cbe0695a30ba76209635181a10","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Animation.js","sha256":"af3f119d4f646d08a73715212ff7a12ab47f09b6636fe99f389b991b5aba1eaa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/OSM.js","sha256":"9f578771e7db1a718c232991dc0ed54fc981d618bab0299a65538193d30ac353","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/ca.js","sha256":"1f20c230c3d0c38f01503b7260ab4cbc31db2095e6fe0a38e7809050979deb4f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/hu.js","sha256":"43e386ac435a84a3a332861c0df01556a9dcdbf448a3b263abba98f6085a21a0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/GeoRSS.js","sha256":"827a70e802ab513277a574bd791ff28b85a0c29e86722c7f4df61dcaaaae05c0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/BaseTypes.js","sha256":"87e4f549665a4cbb8c4455a9eed07318d149f5ea684394b507170df7ff03f125","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Bing.js","sha256":"4acd51c08998749081f5596eafc1064a209e751e2d3d070739ab1f2c2bdbc21f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Strategy/Save.js","sha256":"dfdbcc800a6bd3a2738c6041090081a07087ddebd14cf02792ac84a94d7c7541","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/OSM.js","sha256":"a09d60060f7c204902e1ffea7883f34cca4efb2f6adce0035456c81c6aefe34b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Click.js","sha256":"b4baac0d6d929c69a140974445a914fbf10a73e2896082510d397b4abb2fa6a4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�½��ļ��/Thumbs.db","sha256":"d4c71d7c7c7488582eabe3eb2f1f169a469cb415aa6dc63752d82ef55a1ce44c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"OpenLayers.js","sha256":"71fac56a7186a41158be253d7665209e3bb29d314a77cbaa4d1a83f51bee7cc8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Tile.js","sha256":"40844872b38521586590b413c01bf5ee42abd6398cb65d7e8217ce90c6ea0bf7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/CQL.js","sha256":"967e87a828056b934b50910649f5b1b8d4aedc4d841225c22eda68035b96fbd9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/ru.js","sha256":"dddca8b65fbe098ac3fe9b5fe153012018f7d59dd4102c72989ccc0e053c6130","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/nsisSlideshow.dll","sha256":"ef4be0f68c8ca2ea4434e9daf2b36e5443327a9b2a0fb8857c820183a757b9a4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Grid.js","sha256":"595fb3c20262041b53bd2557011a40179f607c078a0076b783248018bcdf4c36","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/bottom2.bmp","sha256":"41965757945dae3a01a12571fddefe8c35d105d6f88e8d9add205bdd170e8232","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Point.js","sha256":"c3459f81e28b4f2a024ada680842c0c3bee2e9c6fc48407fa5e463b83b10ae51","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Text.js","sha256":"542c749b34eec28d9d8751a61b6451b56046fcddc8bcbd5a2c7ffbce254705d3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/nsDialogs.dll","sha256":"e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/finish_en.bmp","sha256":"cc413ca6f30625bca4f70beb7e9a8cd1cafe3d93553312f18559c2387ef29461","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Kinetic.js","sha256":"546eaad54da0041bd33ea35c609ca835ed71908d584ea7bef50ec70e93d708da","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Projection.js","sha256":"d13dc351574b59f023519b3dd08297048e669be8f768919700028618cdeb8ec2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/KaMap.js","sha256":"4e026a9e955738d381db08e29e74edad36a70f4cda5a5c674be1147b3b875602","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/Header3.bmp","sha256":"b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Control.js","sha256":"ed9276f9aa9c1f2421514df8ee048ef312aedccb2f47a5b9dff56249df7721ee","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Control/Zoom.js","sha256":"a142cf94b304d7cf44e3a2c16bca5856aa79c76722ef17f15a13ed0b9ff81c25","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/deprecated.js","sha256":"c6a495586d4ab0661a2c26c9755bf99a9182b0ab9dbf2bb4702993756af2cf53","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/Slide 01.bmp","sha256":"1e918b00ded2e2bdd568b78bfd3b51f33fb17b1645356c790d15b8caa354e8bc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Vector.js","sha256":"173e119c9dbc68d965058dca4c5deb56a0596de91edf96c8bff346d8dcc1db74","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/WMTS.js","sha256":"0c6aafc28cbdfeeca7412f377210e520f55de64cbe5c85d71528f0e16f51f36e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/GML.js","sha256":"23a75ac4695201df7eb0538a5fd1d9b600198b0471509373c5df69488ec0ba41","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers.js","sha256":"40883639312b636129f99841aaddee60e3434a5647726a49d94ca98a04377c6e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/WMC.js","sha256":"a30c4c39dc712c90cabbdaf0ca4444f1af64fbf77fb9aa11ae5b2faba4fbdcef","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Markers.js","sha256":"6dcbd877fb10f004f0bb0508ca1dd6950e26245328f1910fe1baeb4b3ef4aba7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/Header1_en.bmp","sha256":"42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/.svn/all-wcprops","sha256":"d36b088a39e37d62b03bcd8e942ca2bbf53345fa7b4b1500e6d1748151f8ddbc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/es.js","sha256":"4a00802a65d683c1176d616a6cd3761b3760341ecb8fc15d08c5c4210f56fb44","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Icon.js","sha256":"8717f2d18e86a315edd8077780c138af9aed72b336b499346f830a0ba9fcdfed","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/UTFGrid.js","sha256":"e9c072cd0d658331583f2d44e26b266008c617c62132c9141ccb2e43feaead7c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/SkinProgress.dll","sha256":"888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/WFS.js","sha256":"0fa6c61111f541d9742747b7c89cd1ee5622da5fdb48b4b258f4a8c76aebc9f1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/TileManager.js","sha256":"3b97604b24eb122f22c561bfbf8c6b816abbfa6fa78b7f5e5848561a4cbd4b7a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/un1.bmp","sha256":"dc5eba2f818c2895e7f71ca2ff6a541bc077e1f200032426fa1a72ddf47d5dd4","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Renderer/VML.js","sha256":"7c36f47a2c8620a856744215635c718edc0d7972fd0d02c0a8bf805337a1dca3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/SkinBtn.dll","sha256":"ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Geometry.js","sha256":"a87e4d326ab67083f75a95bc2c971a36560d98d80740e9b80567ce2e40b32957","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/.svn/entries","sha256":"31f0ce1506413284c1b5efe279478c0fe9dceba110b000446aff21beef9355d6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/Slide 01.jpg","sha256":"5cffe1ec979622a55cada9b9c191df476a887c6f0c4a7046382cd0f8848c9743","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/Thumbs.db","sha256":"6344b8057288701c7d78b0d2d205b82af40eec86f718d3dfbfd5f0dc1b101ca7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/TestDLL.dll","sha256":"51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/Text.js","sha256":"2b2215a2f821dc568dbfa27e7d800df5fe0da6b9fbface93efc0d294571444c3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/Zoomify.js","sha256":"7fd44a9a619400de5d7e09caed4252ce29607b05c1fc16de17f621422c1e1673","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�½��ļ��/.svn/entries","sha256":"0b335d6c819bda2640fca034bf370850455a396195e119a2dd2f57a83bb5c7aa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/MsgDLL.dll","sha256":"551adc4d7ed627746cf1213ac49ebe80c798bfdf825f53a6eab21395314c607e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/Atom.js","sha256":"90cdcb21587cedc5bccac7d1f92e7100cdf7e6a0607a92e652da349cc88c67d1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Box.js","sha256":"7416244a54047b76eb738f2086fba0b67555d6d67910fcc0502209d1fa100618","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/.svn/all-wcprops","sha256":"a93f8cb97e37aa935c3327ebdbc9b02c9c0ed8edba0df47e5edfe04b55fd0e92","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Drag.js","sha256":"2eceb6faa12c81d655cb3e809e8a76c83c6c1caba033ca3ae413fc390ad1059f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/ArcIMS.js","sha256":"1cc0a36d4b3cabf92deb10c25aa3030ef3927ad15ece152696b72d74059e2b34","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Protocol/HTTP.js","sha256":"f7728ffd4fc3bbed24aed3bc774b16b9bfe9c652155ef0bd977208c452014b6e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/unHeader.bmp","sha256":"9a89524267d96d9ef3a57338f475c7a27ad07e6fef5ad1aecab50c2bf16d4b54","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer.js","sha256":"2220dda740ea76e8eb68cc7f45dcf66aec8c05e01a6824df3d7403e04878a707","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Tile/Image.js","sha256":"52793ab7ef8f8e75d3ac37c18c98468fbb3ee2cb7345f4455912926280a9ac70","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/progress.dll","sha256":"7d936aebee57e04338308ed8c52ce2c24e21b2978721326be3eb9e90c080834e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler.js","sha256":"3281d8608e5857aaca50ba5071a6236f2dfc856229b452889c75fcf40103af2e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/.svn/prop-base/Slide 01.bmp.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/Progress.bmp","sha256":"a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Util.js","sha256":"75cef7ef141fbbdd40980161bb7f451bbe19dbd6bef8d015cf8d5100c8b06d20","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang.js","sha256":"91de908c1f83004545a0fb33c61a6e4b0c1a8125bd5c003c19d42888cd0df604","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/ButtonEvent.dll","sha256":"d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�� Slides.dat","sha256":"accc4d74044b8813d9c81bcaad45435e89ba2b6feb1a060dd75ac6448e273164","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/GPX.js","sha256":"b201ebb2b7380e616427f1d119ca605f6dc03757a849a2be7a8c867ed1480996","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Handler/Pinch.js","sha256":"44db922493e218abb12cab8a8a65f2e4f6441d251ebbd0ad793455b0fdb9d467","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/ksh.js","sha256":"db28a07950fcc3e6d44484954ce3c82f09f577a5e57d69bd4b935f3d0831a754","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Popup.js","sha256":"044632d6ddf430a721170ff037c702281f7df623267d9c38cfe06bd3e03bff58","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/Rico/Color.js","sha256":"140d81cab8ecb5bb2dc435ea0c159248199852f49ea551a07656a4607d4e6050","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Tile/UTFGrid.js","sha256":"f6d8b7f6032a0c6ffe475e5563b0264059e471284a4077edba617d6a1f8790fe","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides/�½��ļ��/Slide 012.jpg","sha256":"86818fedfc2bd0a2760049e5cb1223b065bb8e618a7a0635ce59bb7ba34a8c65","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Map.js","sha256":"4d73fd6b76097643c8df005e2464a116c0f7daa5daa89ea698baa3ec85ad98de","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UnSlides_en/Slide 01444.jpg","sha256":"97f9656d2b44512074b7356b8af550748f4e6a74e450a044556bbe4037d9d239","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Renderer.js","sha256":"a594c3015e8f14ae24f610d5d0bc6b14abfce226478e4a25d8b5643af03eb9ab","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/da-DK.js","sha256":"60b3d23ef2cb8378682d402506b19cd849384858df0a09ccf7b18b22394ad663","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/lincese.bmp","sha256":"a728d1178b5f81dabc631efbcd4d6eacd260cf677b5772753b713af7af847cfd","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/Firebug/firebug.js","sha256":"3dfddd47ba94f1d31d4427fe981ab71a16979120318bfd955d2c3883656421b9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/it.js","sha256":"99de52f091ec0f3f3ef42869f76ffa8a18d0fee5dec00d63a3bbe5ba3ed444d0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Rule.js","sha256":"a19766f42041ee81eec2d45a16bf681532781795456cf35323e8092b1c490459","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/ArcXML.js","sha256":"dae37165be67fa447762e6abccba743f6363c053e6d0ead142973512f5b59746","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Events.js","sha256":"76aac6cb857cff28ccbc1f54fe596e6e722b39e7f76a2bd30985de36b48e0691","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/KML.js","sha256":"be40e33689bd3f6df14831dddafc6a67db6f0ab121ce993ff48486182bae98b6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Disk Manager User's Guide.pdf","sha256":"e86a4c7c266904a58a77a9f99283ad4b7d0118d9ea7c8ff016cff6fa4b6c8766","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Control/Panel.js","sha256":"744d7088c68a966552107bc2a4b8a1c03650add1bc011b5dcb7a2815288898c3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/XYZ.js","sha256":"c207312bbeb862f45c42888732447c05b33bc24d054732114e9c0b3aa3953a6a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Format/XML.js","sha256":"8a70cea5b779456fd0109bd43a5cc6359ea4cc2b6c3d3fe7780dfd6aeb0a1b54","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Marker.js","sha256":"9d6a728b53f71a26fb7e8f519efd47dae0ce4acc6cbfc49709306bf01b9a3ca3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/bottom.bmp","sha256":"b5884a6823818bffdb3d51af665d73282c8b7173aa3152cc2262b92bc2e3de5b","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/Header2_en.bmp","sha256":"d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Console.js","sha256":"16f46cba85622c3fee5931056332b38fbedebf327466fa4a9e1cce36164e5a57","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Layer/WMS.js","sha256":"ef001213265cb736c04a3bfa1462896f648701f9b57b4a5cf4fc8ddc384db97e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Lang/en.js","sha256":"0bb072f8d39cdc1aa4a0844d1520874f260397809eea6d648155a4bc5cd9927c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"lib/OpenLayers/Control/Split.js","sha256":"51e72bb6b06f2b87cd6682b31f585c498664e46c26f8aab4229fa0ff5a022aad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/System.dll","sha256":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ButtonEvent.dll","sha256":"d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"FindProcDLL.dll","sha256":"a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"SkinBtn.dll","sha256":"ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"System.dll","sha256":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"TestDLL.dll","sha256":"51cf8a77459a651d105ff9689b194e49f594bceeb162c98066114627085a0a9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"nsDialogs.dll","sha256":"e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header1.bmp","sha256":"4f9565a0137602b3494500d80bc2b4b94e62f5685a8ae4838575cdbdf4653a8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header1_en.bmp","sha256":"42979c5824237e58d245c7a6eb8c530995ab2b0128a54e1bc61d27e9175efea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header2.bmp","sha256":"0d307434e22558391a4a851b28366592cc54ffca943539bc78ca1aa8984cc0c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header2_en.bmp","sha256":"d5c3fd9fa63100e2ec5d0f182b9a930af65e20f25a68df3de54f96b6c9219867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header3.bmp","sha256":"b652a16bd8971c92d4f71581a4cc503e4ba41ecaa74e171384d340dc36875104","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Header3_en.bmp","sha256":"d6f9e215c0b3f98affd76b4c81af655971e30a9bb458e909f4b2f42efbca9d4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Progress.bmp","sha256":"a4d2964ac4af2266055c946bdf1ddf08780e37e71da8f1929a74f1e398553ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"ProgressBar.bmp","sha256":"57029e1e650eb381efc54d9b7d54384968ed81b4c8342a58260b309e328aa999","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"all-wcprops","sha256":"097c218e38b7aa560b3ab75c2175458bcb1fff19abb27a03bd18fecc8767a858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"entries","sha256":"0c66e4dfe9e05c318cbb2fef0c4e7fb7efa1210f218e4141d5d4f5648ce9adc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Slide 01.jpg.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Slide 02.jpg.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Slides.dat.bak.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Slides.dat.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Thumbs.db.svn-base","sha256":"ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nsbD14D.tmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\FindProcDLL.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\button1.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\SkinBtn.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\button2.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header1.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header2.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header3.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header1_en.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header2_en.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Header3_en.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Progress.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\ProgressBar.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\welcome.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\lincese.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\finish.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\finish_en.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\bottom.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\close.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\un1.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\unHeader.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\bottom1.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\bottom2.bmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\Slide 01.jpg","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\Slide 02.jpg","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\Slides.dat","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\Slides.dat.bak","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\Thumbs.db","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\all-wcprops","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\entries","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\prop-base\\Slide 01.jpg.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\prop-base\\Slide 02.jpg.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\prop-base\\Slides.dat.bak.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\prop-base\\Slides.dat.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\prop-base\\Thumbs.db.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slide 01.jpg.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slide 02.jpg.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slides.dat.bak.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Slides.dat.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\text-base\\Thumbs.db.svn-base","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\Slides\\.svn\\tmp","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\ButtonEvent.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"path":"%TEMP%\\nswD1CB.tmp\\TestDLL.dll","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Local\\SM0:5652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"SM0:5652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"SM0:5652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]},{"name":"Local\\SM0:5652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad86ff276507a2cc1028d0e"}]}]}},"report_ids":{"sandbox_job_ids":["6ad86ff276507a2cc1028d0e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 8538f39c7fe3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 8538f39c7fe3…. Threat score 0/100. 0/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979"}],["$","meta","4",{"property":"og:title","content":"Sample 8538f39c7fe3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 8538f39c7fe3…. Threat score 0/100. 0/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8538f39c7fe343c8de4a1faf0f871df125a6f5b8c2b8e75ff97533e3fa389979"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 8538f39c7fe3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 8538f39c7fe3…. Threat score 0/100. 0/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]