24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T476,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample cf3295ec4faa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cf3295ec4faa…. Malware family: Malware. Threat score 100/100. 1/30 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a"],"about":{"@type":"SoftwareApplication","name":"RDWorksV8Setup8.01.18.exe","applicationCategory":["peexe","executable"],"identifier":"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":1,"total":30},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T498,Found API call GetVersion@KERNEL32.dll (Target: "RDLGP.dll.145135836"; Stream UID: "57316-1571-100010A0") which is directly followed by "cmp eax, 80000000h" and "jnc 10001152h". See related instructions: "... +0 push ebx +1 push esi +2 push edi +3 call dword ptr [1003C114h] ;GetVersion +9 cmp eax, 80000000h +14 jnc 10001152h" ... at 57316-1571-100010A0 Found API call GetSystemTime@KERNEL32.dll (Target: "MSVCRTD.dll.362668718"; Stream UID: "5144-314-10243000") which is directly followed by "cmp edx, eax" and "jne 10243098h". See related instructions: "... +23 call dword ptr [1024D23Ch] ;GetSystemTime +29 mov edx, dword ptr [ebp-06h] +32 and edx, 0000FFFFh +38 xor eax, eax +40 mov ax, word ptr [102594CAh] +46 cmp edx, eax +48 jne 10243098h" ... at 5144-314-10243000 Found API call GetVersion@KERNEL32.dll (Target: "MSVCRTD.dll.362668718"; Stream UID: "5144-1068-1020B430") which is directly followed by "cmp eax, 03h" and "jne 1020B47Fh". See related instructions: "... +14 call dword ptr [1024D038h] ;GetVersion +20 mov dword ptr [ebp-04h], eax +23 mov eax, dword ptr [ebp-04h] +26 and eax, 000000FFh +31 cmp eax, 03h +34 jne 1020B47Fh" ... at 5144-1068-1020B43026:T9d9,Antivirus vendors marked dropped file "MFCO42D.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ExFileMgr.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "RDLGP.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RDCAM.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "rdloadV8.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "MSVCRTD.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ftbusui.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UnInst64.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ftdiport.cat" as clean (type is "data"), Antivirus vendors marked dropped file "RDElement.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "rdloadV8.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ftcserco.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Element.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ftcserco.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ExCurve.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RDWorksV8Uninstall.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RDWorksSetUpV8.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UnInst32.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RDReader.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ftlang.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")27:T636,""/c md c:\newpr" on 2017-10-2.17:59:08.339, ""/c md c:\newpr\ImgLib" on 2017-10-2.17:59:08.399 ""/c copy CFG\ImgLib\*.* c:\newpr\ImgLib" on 2017-10-2.17:59:09.630, ""/c copy Lang\SetUp_chs.ini c:\newpr\SetUpCHS.ini" on 2017-10-2.17:59:09.680 ""/c copy Lang\SetUp_cht.ini c:\newpr\SetUpCHT.ini" on 2017-10-2.17:59:09.731, ""/c copy Lang\SetUp_eng.ini c:\newpr\SetUpENG.ini" on 2017-10-2.17:59:09.781 ""/c copy Lang\SetUp_other.ini c:\newpr\SetUpJPN.ini" on 2017-10-2.17:59:09.831, ""/c copy Info\Info_Sche.txt c:\newpr\Info_Sche.txt" on 2017-10-2.17:59:09.881 ""/c copy Info\Info_TChe.txt c:\newpr\Info_TChe.txt" on 2017-10-2.17:59:09.941, ""/c copy Info\Info_En.txt c:\newpr\Info_En.txt" on 2017-10-2.17:59:09.991 ""/c copy Info\Info_Other.txt c:\newpr\Info_Other.txt" on 2017-10-2.17:59:10.041, ""/c copy Lang\Lang_chs.ini c:\newpr\laserwork\Lang_chs.ini" on 2017-10-2.17:59:10.141 ""/c copy Lang\Lang_cht.ini c:\newpr\laserwork\Lang_cht.ini" on 2017-10-2.17:59:10.201, ""/c copy Lang\Lang_eng.ini c:\newpr\laserwork\Lang_eng.ini" on 2017-10-2.17:59:10.261 ""/c copy Lang\Lang_other.ini c:\newpr\laserwork\Lang_other.ini" on 2017-10-2.17:59:10.331, ""/c copy Lang\Plug_chs.ini c:\newpr\rdplug\Lang_chs.ini" on 2017-10-2.17:59:10.392 ""/c copy Lang\Plug_cht.ini c:\newpr\rdplug\Lang_cht.ini" on 2017-10-2.17:59:10.452, ""/c copy Lang\Plug_eng.ini c:\newpr\rdplug\Lang_eng.ini" on 2017-10-2.17:59:11.062 ""/c copy Lang\Plug_other.ini c:\newpr\rdplug\Lang_other.ini" on 2017-10-2.17:59:11.223, ""/c copy Lang\Preview_chs.ini c:\newpr\com\Preview_chs.ini" on 2017-10-2.17:59:11.33328:T97e,Spawned process "cmd.exe" with commandline ""/c md c:\newpr" (UID: 00018357-00002720), Spawned process "cmd.exe" with commandline ""/c md c:\newpr\ImgLib" (UID: 00018364-00002724) Spawned process "cmd.exe" with commandline ""/c copy CFG\ImgLib\*.* c:\newpr\ImgLib" (UID: 00018486-00002808), Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_chs.ini c:\newpr\SetUpCHS.ini" (UID: 00018491-00002844) Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_cht.ini c:\newpr\SetUpCHT.ini" (UID: 00018496-00003088), Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_eng.ini c:\newpr\SetUpENG.ini" (UID: 00018501-00002980) Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_other.ini c:\newpr\SetUpJPN.ini" (UID: 00018506-00003004), Spawned process "cmd.exe" with commandline ""/c copy Info\Info_Sche.txt c:\newpr\Info_Sche.txt" (UID: 00018512-00003080) Spawned process "cmd.exe" with commandline ""/c copy Info\Info_TChe.txt c:\newpr\Info_TChe.txt" (UID: 00018517-00002964), Spawned process "cmd.exe" with commandline ""/c copy Info\Info_En.txt c:\newpr\Info_En.txt" (UID: 00018522-00003124) Spawned process "cmd.exe" with commandline ""/c copy Info\Info_Other.txt c:\newpr\Info_Other.txt" (UID: 00018528-00003200), Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_chs.ini c:\newpr\laserwork\Lang_chs.ini" (UID: 00018538-00003160) Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_cht.ini c:\newpr\laserwork\Lang_cht.ini" (UID: 00018544-00003184), Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_eng.ini c:\newpr\laserwork\Lang_eng.ini" (UID: 00018550-00003204) Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_other.ini c:\newpr\laserwork\Lang_other.ini" (UID: 00018556-00003324), Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_chs.ini c:\newpr\rdplug\Lang_chs.ini" (UID: 00018562-00003268) Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_cht.ini c:\newpr\rdplug\Lang_cht.ini" (UID: 00018568-00003328), Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_eng.ini c:\newpr\rdplug\Lang_eng.ini" (UID: 00018575-00003340) Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_other.ini c:\newpr\rdplug\Lang_other.ini" (UID: 00018636-00003356), Spawned process "cmd.exe" with commandline ""/c copy Lang\Preview_chs.ini c:\newpr\com\Preview_chs.ini" (UID: 00018656-00003380)29:T5ca,"MFCO42D.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ExFileMgr.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "RDLGP.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDCAM.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rdloadV8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "MSVCRTD.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ftbusui.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "UnInst64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ftdiport.cat" has type "data" "RDElement.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rdloadV8.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ftcserco.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "Element.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "ftcserco.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "ExCurve.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDCutting.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDWorksV8Uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RDWorksSetUpV8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "UnInst32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"2a:T50c,"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe.bin" was detected as "BobSoft Mini Delphi -> BoB / BobSoft" "MFCO42D.dll" was detected as "Microsoft visual C++ v6.0 (Debug version)" "RDLGP.dll" was detected as "Microsoft visual C++ 6.0 DLL" "RDCAM.dll" was detected as "Microsoft visual C++ 6.0 DLL" "MSVCRTD.dll" was detected as "Microsoft visual C++ v6.0 (Debug version)" "ftbusui.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "UnInst64.exe" was detected as "Microsoft visual C++ 5.0" "RDElement.dll" was detected as "Microsoft visual C++ 6.0 DLL" "rdloadV8.dll" was detected as "Microsoft visual C++ 6.0 DLL" "ftcserco.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "ExCurve.dll" was detected as "Microsoft visual C++ 6.0 DLL" "RDCutting.dll" was detected as "Microsoft visual C++ 6.0 DLL" "RDWorksV8Uninstall.exe" was detected as "Microsoft visual C++ 5.0" "RDWorksSetUpV8.exe" was detected as "Microsoft visual C++ 5.0" "RDReader.dll" was detected as "Microsoft visual C++ 6.0 DLL" "ftlang.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "ParaMgr.dll" was detected as "Microsoft visual C++ 6.0 DLL" "ExLoader.dll" was detected as "Microsoft visual C++ 6.0 DLL" "ExDraw.dll" was detected as "Microsoft visual C++ 6.0 DLL"2b:T5fc,"MFCO42D.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ExFileMgr.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "RDLGP.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDCAM.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rdloadV8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "MSVCRTD.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ftbusui.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "UnInst64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RDElement.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rdloadV8.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ftcserco.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "Element.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "ftcserco.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows" "ExCurve.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDCutting.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RDWorksV8Uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RDWorksSetUpV8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "UnInst32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RDReader.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2c:Tffc,File "ftdiport.cat" is a certificate (Owner: CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.; SerialNumber: 6a0b994fc00025ab11db451f587a67a2; Valid From: 09/16/2006 02:04:47; Until: 09/15/2019 08:00:00; Fingerprints: MD5=B9:56:D5:DA:60:80:B3:42:72:D1:9D:08:03:A4:E7:AA; SHA1=3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45) File "ftdiport.cat" is a certificate (Owner: CN=Microsoft Time-Stamp Service, OU=nCipher DSE ESN:7A82-688A-9F92, OU=MOPR, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 6106942d000000000009; Valid From: 07/25/2008 20:02:17; Until: 07/25/2013 20:12:17; Fingerprints: MD5=91:E8:79:73:30:EE:59:2C:D1:56:16:6D:1D:42:4D:10; SHA1=05:FE:CB:74:5F:7F:3B:1A:0E:26:2A:73:43:5C:CB:7E:AA:ED:8B:37) File "ftdiport.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, OU=MOPR, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Hardware Compatibility PCA, OU=Copyright c 2002 Microsoft Corp., O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 6102d0d7000200000016; Valid From: 12/19/2011 23:40:20; Until: 03/19/2013 23:40:20; Fingerprints: MD5=81:75:C5:9E:6F:03:72:0F:C2:E6:D2:BB:A9:F6:94:28; SHA1=21:85:75:D3:D2:C7:ED:1F:BD:F9:95:6B:DD:BF:1F:76:C5:2A:E8:5D) File "ftdiport.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility PCA, OU=Copyright c 2002 Microsoft Corp., O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.; SerialNumber: 613312e4000000000002; Valid From: 11/01/2010 22:31:42; Until: 11/01/2015 22:41:42; Fingerprints: MD5=C3:AC:5D:B7:E0:F7:ED:57:44:4B:F6:1E:A1:BA:15:B5; SHA1=DC:03:16:1C:91:D8:3C:29:6E:8C:EE:9B:87:B9:FF:37:1F:A0:5F:A4) File "ftdibus.cat" is a certificate (Owner: CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.; SerialNumber: 6a0b994fc00025ab11db451f587a67a2; Valid From: 09/16/2006 02:04:47; Until: 09/15/2019 08:00:00; Fingerprints: MD5=B9:56:D5:DA:60:80:B3:42:72:D1:9D:08:03:A4:E7:AA; SHA1=3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45) File "ftdibus.cat" is a certificate (Owner: CN=Microsoft Time-Stamp Service, OU=nCipher DSE ESN:7A82-688A-9F92, OU=MOPR, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 6106942d000000000009; Valid From: 07/25/2008 20:02:17; Until: 07/25/2013 20:12:17; Fingerprints: MD5=91:E8:79:73:30:EE:59:2C:D1:56:16:6D:1D:42:4D:10; SHA1=05:FE:CB:74:5F:7F:3B:1A:0E:26:2A:73:43:5C:CB:7E:AA:ED:8B:37) File "ftdibus.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, OU=MOPR, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Hardware Compatibility PCA, OU=Copyright c 2002 Microsoft Corp., O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 6102d0d7000200000016; Valid From: 12/19/2011 23:40:20; Until: 03/19/2013 23:40:20; Fingerprints: MD5=81:75:C5:9E:6F:03:72:0F:C2:E6:D2:BB:A9:F6:94:28; SHA1=21:85:75:D3:D2:C7:ED:1F:BD:F9:95:6B:DD:BF:1F:76:C5:2A:E8:5D) File "ftdibus.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility PCA, OU=Copyright c 2002 Microsoft Corp., O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.; SerialNumber: 613312e4000000000002; Valid From: 11/01/2010 22:31:42; Until: 11/01/2015 22:41:42; Fingerprints: MD5=C3:AC:5D:B7:E0:F7:ED:57:44:4B:F6:1E:A1:BA:15:B5; SHA1=DC:03:16:1C:91:D8:3C:29:6E:8C:EE:9B:87:B9:FF:37:1F:A0:5F:A4)2d:T54e,"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe.bin" claimed CRC 245254 while the actual is CRC 7833236 "ExFileMgr.dll" claimed CRC 62388 while the actual is CRC 801705 "rdloadV8.dll" claimed CRC 33097 while the actual is CRC 354388 "MSVCRTD.dll" claimed CRC 397285 while the actual is CRC 33097 "ftbusui.dll" claimed CRC 152732 while the actual is CRC 397285 "ftcserco.dll" claimed CRC 107644 while the actual is CRC 362937 "Element.dll" claimed CRC 66062 while the actual is CRC 107644 "ftcserco.dll" claimed CRC 95592 while the actual is CRC 66062 "ftlang.dll" claimed CRC 266179 while the actual is CRC 88366 "ftd2xx.dll" claimed CRC 236267 while the actual is CRC 93048 "ftd2xx64.dll" claimed CRC 267807 while the actual is CRC 1936576 "ftserui2.dll" claimed CRC 111909 while the actual is CRC 267807 "ftserui2.dll" claimed CRC 80088 while the actual is CRC 68391 "MFC42D.dll" claimed CRC 937083 while the actual is CRC 80088 "drIptBdrFe.dll" claimed CRC 80360 while the actual is CRC 937083 "FTD2XX.dll" claimed CRC 267053 while the actual is CRC 117569 "DPInst32.exe" claimed CRC 833107 while the actual is CRC 267053 "ftbusui.dll" claimed CRC 152322 while the actual is CRC 833107 "DPInst64.exe" claimed CRC 986557 while the actual is CRC 1470204 "ftlang.dll" claimed CRC 254356 while the actual is CRC 1664932e:T533,RegCloseKey OpenProcessToken GetUserNameA RegCreateKeyExA RegOpenKeyExA RegEnumKeyExA GetFileAttributesA GetVersionExA GetModuleFileNameA LoadLibraryA WinExec GetFileSize OpenProcess CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetCommandLineA GetProcAddress GetTempPathA GetModuleHandleA FindFirstFileA WriteFile GetStartupInfoA GetComputerNameA FindNextFileA TerminateProcess Sleep CreateFileA VirtualAlloc ShellExecuteExA ShellExecuteA FindWindowA GetUpdateRgn CopyFileA GetTickCount LockResource OutputDebugStringA FindResourceA IsDebuggerPresent CreateThread bind (Ordinal #2) sendto (Ordinal #20) recvfrom (Ordinal #17) closesocket (Ordinal #3) WSAStartup (Ordinal #115) socket (Ordinal #23) GetDriveTypeW GetDriveTypeA FindFirstFileW GetFileAttributesW GetModuleFileNameW ExitThread CreateDirectoryW DeleteFileW FindNextFileW CreateFileW GetCommandLineW CreateProcessA CreateProcessW DeviceIoControl GetModuleHandleW LoadLibraryW RegOpenKeyW OutputDebugStringW VirtualProtect LoadLibraryExA GetVersionExW LoadLibraryExW GetStartupInfoW RegEnumKeyA CreateToolhelp32Snapshot Process32Next Process32First FindResourceExW OpenFileMappingA MapViewOfFile CreateFileMappingA RegOpenKeyExW GetModuleFileNameExA EnumProcesses GetModuleHandleExW2f:T145b,Spawned process "" (UID: 00014569-00002888) Spawned process "cmd.exe" with commandline ""/c md c:\newpr" (UID: 00018357-00002720), Spawned process "cmd.exe" with commandline ""/c md c:\newpr\ImgLib" (UID: 00018364-00002724) Spawned process "cmd.exe" with commandline ""/c copy CFG\ImgLib\*.* c:\newpr\ImgLib" (UID: 00018486-00002808), Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_chs.ini c:\newpr\SetUpCHS.ini" (UID: 00018491-00002844) Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_cht.ini c:\newpr\SetUpCHT.ini" (UID: 00018496-00003088), Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_eng.ini c:\newpr\SetUpENG.ini" (UID: 00018501-00002980) Spawned process "cmd.exe" with commandline ""/c copy Lang\SetUp_other.ini c:\newpr\SetUpJPN.ini" (UID: 00018506-00003004), Spawned process "cmd.exe" with commandline ""/c copy Info\Info_Sche.txt c:\newpr\Info_Sche.txt" (UID: 00018512-00003080) Spawned process "cmd.exe" with commandline ""/c copy Info\Info_TChe.txt c:\newpr\Info_TChe.txt" (UID: 00018517-00002964), Spawned process "cmd.exe" with commandline ""/c copy Info\Info_En.txt c:\newpr\Info_En.txt" (UID: 00018522-00003124) Spawned process "cmd.exe" with commandline ""/c copy Info\Info_Other.txt c:\newpr\Info_Other.txt" (UID: 00018528-00003200), Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_chs.ini c:\newpr\laserwork\Lang_chs.ini" (UID: 00018538-00003160) Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_cht.ini c:\newpr\laserwork\Lang_cht.ini" (UID: 00018544-00003184), Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_eng.ini c:\newpr\laserwork\Lang_eng.ini" (UID: 00018550-00003204) Spawned process "cmd.exe" with commandline ""/c copy Lang\Lang_other.ini c:\newpr\laserwork\Lang_other.ini" (UID: 00018556-00003324), Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_chs.ini c:\newpr\rdplug\Lang_chs.ini" (UID: 00018562-00003268) Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_cht.ini c:\newpr\rdplug\Lang_cht.ini" (UID: 00018568-00003328), Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_eng.ini c:\newpr\rdplug\Lang_eng.ini" (UID: 00018575-00003340) Spawned process "cmd.exe" with commandline ""/c copy Lang\Plug_other.ini c:\newpr\rdplug\Lang_other.ini" (UID: 00018636-00003356), Spawned process "cmd.exe" with commandline ""/c copy Lang\Preview_chs.ini c:\newpr\com\Preview_chs.ini" (UID: 00018656-00003380) Spawned process "cmd.exe" with commandline ""/c copy Lang\Preview_cht.ini c:\newpr\com\Preview_cht.ini" (UID: 00018664-00003408), Spawned process "cmd.exe" with commandline ""/c copy Lang\Preview_eng.ini c:\newpr\com\Preview_eng.ini" (UID: 00018672-00003436) Spawned process "cmd.exe" with commandline ""/c copy Lang\Preview_other.ini c:\newpr\com\Preview_other.ini" (UID: 00018684-00003448), Spawned process "cmd.exe" with commandline ""/c copy Lang\LGP_chs.ini c:\newpr\com\LGP_chs.ini" (UID: 00018693-00003476) Spawned process "cmd.exe" with commandline ""/c copy Lang\LGP_cht.ini c:\newpr\com\LGP_cht.ini" (UID: 00018701-00000352), Spawned process "cmd.exe" with commandline ""/c copy Lang\LGP_eng.ini c:\newpr\com\LGP_eng.ini" (UID: 00018710-00003536) Spawned process "cmd.exe" with commandline ""/c copy Lang\LGP_other.ini c:\newpr\com\LGP_other.ini" (UID: 00018718-00002692), Spawned process "cmd.exe" with commandline ""/c copy CFG\config c:\newpr\laserwork\config" (UID: 00018725-00000272) Spawned process "cmd.exe" with commandline ""/c copy CFG\Plug_config c:\newpr\rdplug\config" (UID: 00018733-00003032), Spawned process "cmd.exe" with commandline ""/c copy CFG\Soft.ini c:\newpr\laserwork\Soft.ini" (UID: 00018740-00003024) Spawned process "cmd.exe" with commandline ""/c copy CFG\Soft.ini c:\newpr\rdplug\Soft.ini" (UID: 00018748-00002848), Spawned process "cmd.exe" with commandline ""/c copy CFG\tips c:\newpr\com\tips" (UID: 00018761-00003056) Spawned process "cmd.exe" with commandline ""/c copy CFG\Param.lib c:\newpr\Param.lib" (UID: 00018769-00003620), Spawned process "cmd.exe" with commandline ""/c copy Res\Logo.ico c:\newpr\Logo.ico" (UID: 00018784-00003628) Spawned process "cmd.exe" with commandline ""/c copy Res\Splash.bmp c:\newpr\Splash.bmp" (UID: 00018795-00003660), Spawned process "cmd.exe" with commandline ""/c copy Res\RLD.ico c:\newpr\RLD.ico" (UID: 00018805-00003700) Spawned process "cmd.exe" with commandline ""/c copy RDMgr.dll c:\newpr\com\RDMgr.dll" (UID: 00018814-00003624), Spawned process "cmd.exe" with commandline ""/c copy Lang\help.chm c:\newpr\laserwork\help.chm" (UID: 00018824-00003704) Spawned process "cmd.exe" with commandline ""/c copy Lang\help1.chm c:\newpr\laserwork\help1.chm" (UID: 00018834-00000596), Spawned process "cmd.exe" with commandline ""/c copy Lang\help2.chm c:\newpr\laserwork\help2.chm" (UID: 00018844-00000468) Spawned process "cmd.exe" with commandline ""/c copy Lang\help3.chm c:\newpr\laserwork\help3.chm" (UID: 00018853-00001780), Spawned process "cmd.exe" with commandline ""/c copy Lang\help4.chm c:\newpr\laserwork\help4.chm" (UID: 00018883-00001208) Spawned process "RDWorksSetUpV8.exe" (UID: 00018892-00003804)30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAR3d3dAAAAHd3AAAAAAAAB3iP/4dwAAd4h3YAAAAAAHj/j///hwB3j/+HcAAAAAiP//////h3iP///4dwAACI////////iP+P/4/4cAAAj/////////f4j/+IiHAAAI/////////3iI//iIhwAACP///4j///+IiP/4iIcAAAiP//93j///iIj/iIiHAAAI////iP///4iI/4iIhwAACP////////+IiP+IiIcAAAiP///////4iIiIiIiHAAAIj///////+IiI+IiIhwAAAIj//////4iIiIiIh3cAAAAIj/////iIiIh3eIiHdAAAAIiP+IiIiIiIi3eIiIdwAAAAiIiIiIiIiLu4eP//d2AAAAAACIiIiIu7u7d4d3dwAAAAAAiIiIi7u7u7t3QAAAAAAAAIiIiIu7u7u7t3AAAAAAAACIiLu7u7u7u7h3AAAAAAAAiIu7u7u7iIiIh3AAAAAAAIi7u7u7uIiIiIdwAAAAAAiLu7u7u4iIiIh3AAAAAAAIiIiLu7////+HcAAAAAAAiIiIiIj////4dwAAAAAAAIiIiP+Hj///dwAAAAAAAAAIiI//gHj/93AAAAAAAAAAAAiI+HAHj3cAAAAAAAAAAAAACIgAAHdwAAAAAAAAAAAAAAAAAAAAAAAAAAD4B+H/8AHAf+AAgB/AAAAPgAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAAPAAAAA4AAAAPgAAAD/wAAA/8AAA//AAAH/wAAA/8AAAP/AAAH/gAAD/4AAB/8AAA//AAA//4AAf//gYP//+PH//////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==49:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==50:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790571527649,"unified_at":"2026-09-28T04:58:47.649Z","metadata":{"hashes":{"sha256":"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a","sha1":"819730622ce1bd931930346dac946487a08815ab","md5":"a33a4d539da00f30a1abe903e90e9ac3","sha512":"5ad924156e9069c96e6c27e3839de1853424fb514b3810f083d4512c19fb5853dbb07c4386aa3787eb85993311668e822aa78059d4b0bb274e44e3f93fa2d93a","ssdeep":"196608:0tI20F6Fjz/rosSS0lwN0tBpHCEBQTKeqkMPlaTZ:byJiG0iEBT1KZ","ssdeep_chunks":["196608:0tI20F6","196608:tI20F6F","196608:I20F6Fj","196608:20F6Fjz","196608:0F6Fjz/","196608:F6Fjz/r","196608:6Fjz/ro","196608:Fjz/ros","196608:jz/rosS","196608:z/rosSS","196608:/rosSS0","196608:rosSS0l","196608:osSS0lw","196608:sSS0lwN","196608:SS0lwN0","196608:S0lwN0t","196608:0lwN0tB","196608:lwN0tBp","196608:wN0tBpH","196608:N0tBpHC","196608:0tBpHCE","196608:tBpHCEB","196608:BpHCEBQ","196608:pHCEBQT","196608:HCEBQTK","196608:CEBQTKe","196608:EBQTKeq","196608:BQTKeqk","196608:QTKeqkM","196608:TKeqkMP","196608:KeqkMPl","196608:eqkMPla","196608:qkMPlaT","196608:kMPlaTZ","393216:0tI20F6","393216:tI20F6F","393216:I20F6Fj","393216:20F6Fjz","393216:0F6Fjz/","393216:F6Fjz/r","393216:6Fjz/ro","393216:Fjz/ros","393216:jz/rosS","393216:z/rosSS","393216:/rosSS0","393216:rosSS0l","393216:osSS0lw","393216:sSS0lwN","393216:SS0lwN0","393216:S0lwN0t","393216:0lwN0tB","393216:lwN0tBp","393216:wN0tBpH","393216:N0tBpHC","393216:0tBpHCE","393216:tBpHCEB","393216:BpHCEBQ","393216:pHCEBQT","393216:HCEBQTK","393216:CEBQTKe","393216:EBQTKeq","393216:BQTKeqk","393216:QTKeqkM","393216:TKeqkMP","393216:KeqkMPl","393216:eqkMPla","393216:qkMPlaT","393216:kMPlaTZ","196608:byJiG0i","196608:yJiG0iE","196608:JiG0iEB","196608:iG0iEBT","196608:G0iEBT1","196608:0iEBT1K","196608:iEBT1KZ"],"imphash":"c9adc83b45e363b21cd6b11b5da0501f"},"file_info":{"file_name":"RDWorksV8Setup8.01.18.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":7779854,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506964173000,"last_seen":1673779618000,"last_multi_scan":1673779618000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":30},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":18,"malicious_count":7,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38057-516-1000F77C\n SetUnhandledExceptionFilter@KERNEL32.dll at 5144-1465-1020A440\n SetUnhandledExceptionFilter@KERNEL32.dll at 5144-1424-1020A460","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 5144-314-10243000\n GetLocalTime@KERNEL32.dll at 5144-349-10241E20\n GetLocalTime@KERNEL32.dll at 5144-347-10241F40\n GetLocalTime@KERNEL32.dll at 5144-342-10242340\n GetLocalTime@KERNEL32.dll at 5144-346-10242010\n GetLocalTime@KERNEL32.dll at 5144-341-10242420\n GetSystemTimeAsFileTime@KERNEL32.dll at 5144-327-10242750\n GetSystemTimeAsFileTime@KERNEL32.dll at 5144-353-10241B00\n GetSystemTimeAsFileTime@KERNEL32.dll at 5144-1402-102427C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 38057-466-100103BC\n GetTimeZoneInformation@KERNEL32.dll at 5144-314-10243000\n GetTimeZoneInformation@KERNEL32.dll at 5144-353-10241B00","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 49941-2457-5F53A3CA\n GetVersion@KERNEL32.dll at 49941-2330-5F5418E8\n GetVersion@KERNEL32.dll at 49941-2331-5F541873\n GetVersion@KERNEL32.dll at 57316-1571-100010A0\n GetVersion@KERNEL32.dll at 5144-1068-1020B430","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 38057-378-1000BC67\n GetUserDefaultLCID@KERNEL32.dll at 38057-377-1000BCA3\n EnumSystemLocalesA@KERNEL32.dll at 38057-380-1000BC00\n GetUserDefaultLCID@KERNEL32.dll at 38057-853-1000B70A\n EnumSystemLocalesA@KERNEL32.dll at 38057-902-1000BBD4\n GetUserDefaultLCID@KERNEL32.dll at 45266-250-004044A0\n GetUserDefaultLCID@KERNEL32.dll at 49941-2923-5F527C95","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.dll at 5144-1932-1024C3EA\n GetDiskFreeSpaceA@KERNEL32.dll at 5144-881-102238C0","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RDWORKSSETUPV8.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RDWORKSSETUPV8.EXE\")\n \"RDWorksSetUpV8.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RDWORKSSETUPV8.EXE\")\n \"RDWorksSetUpV8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RDWORKSSETUPV8.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\develo~1\\cdm\\coinst\\ftcserco\\objfre_wnet_x86\\i386\\ftcserco.pdb\"\n \"c:\\Development\\CDM\\FTBUSUI\\Release\\FTBUSUI.pdb\"\n \".pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\$inst\\2.tmp\"\n \"\" created file \"%TEMP%\\$inst\\temp_0.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$26","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$27","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"@$&%04\\driver\\ftdibus.cat\"\n Heuristic match: \"@$&%04\\driver\\ftdiport.cat\"\n Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Encoding: identity\nUser-Agent: Microsoft BITS/7.5\nX-Old-UID: cnt=0\nX-Last-HR: 0x80042194\nX-Last-HTTP-Status-Code: 404\n\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"command.com\"\n Heuristic match: \"and.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2a","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Checks a device property (often used to detect VM artifacts)","description":"SetupDiGetDeviceRegistryPropertyA@SETUPAPI.dll at 38057-140-10002070\n SetupDiGetDeviceRegistryPropertyA@SETUPAPI.dll at 38057-955-1000281C","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-30","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .data with unusual entropies 7.2072388822\n 7.26871920876","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"ftbusui.dll.389703613\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RDWorksSetUpV8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.dll at 49941-2640-5F532D8A\n FindResourceA@KERNEL32.dll at 49941-3541-5F50DE36\n LockResource@KERNEL32.dll at 57316-1529-10003E80\n LockResource@KERNEL32.dll at 57316-1499-100063B0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"PcaSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2b","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"The input sample dropped/contains a certificate file","description":"$2c","origin":"Binary File","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.1.100\"\n \"192.168.1.10\"\n \"2.08.24.1\"\n \"2.08.23.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"RDWorksSetUpV8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 45266-243-0040F332","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$2d","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2e","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"MFCO42D.dll\" claims program is from Thu Jun 18 01:45:13 1998\n \"MSVCRTD.dll\" claims program is from Wed Jun 17 16:24:59 1998\n \"MFC42D.dll\" claims program is from Thu Jun 18 01:44:01 1998","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to check the local/global descriptor table","description":"sldt word ptr [eax-7FFFF064h] at 42732-409-10008660\n sldt word ptr [eax-7FFFEDEDh] at 42732-581-10008482\n sldt word ptr [eax-7FFFF707h] at 42732-359-10008654\n sldt word ptr [eax-7FFFEDA6h] at 44075-326-10008FFC\n sldt word ptr [eax-7FFFE802h] at 57316-1216-10036494\n sldt word ptr [eax-7FFFEDF2h] at 60744-88-1000148C\n sldt word ptr [eax-7FFFFCA6h] at 62640-71-100017C8\n sldt word ptr [eax-7FFFEDF2h] at 62640-102-10001770\n sldt word ptr [eax-7FFFF911h] at 512-98-004026F8\n sldt word ptr [eax-7FFFFBBFh] at 512-64-004025CC\n sldt word ptr [eax-7FFFF2F7h] at 3400-470-1000AB84","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-25","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/64 Antivirus vendors marked sample as malicious (7% detection rate)\n 1/41 Antivirus vendors marked sample as malicious (2% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 38057-314-10002010","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 4 bytes to a remote process \"C:\\newpr\\RDWorksSetUpV8.exe\" (Handle: 496)\n \"\" wrote 1500 bytes to a remote process \"C:\\newpr\\RDWorksSetUpV8.exe\" (Handle: 496)\n \"\" wrote 32 bytes to a remote process \"C:\\newpr\\RDWorksSetUpV8.exe\" (Handle: 496)\n \"\" wrote 52 bytes to a remote process \"C:\\newpr\\RDWorksSetUpV8.exe\" (Handle: 496)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"_path_CreateDesktopShortCut@PathMgr.dll at 45266-226-0040F368","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Contains ability to create/switch the desktop"}],"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]}]},"activity":{"stats":{"process_count":44,"spawned_processes_count":44,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":53,"files_written_count":222,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"59d270647ca3e15e9f4a9f83","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Undefined","submit_name":"RDWorksV8Setup8.01.18.exe","analysis_start_time":"2017-10-02T17:57:36+00:00","indicators_count":{"informative":20,"suspicious":24,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}],"processes":[{"pid":2888,"ppid":0,"name":"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe","command_line":"","sha256":"cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a","normalized_path":"C:\\cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe","uid":"00014569-00002888","icon":"$30"},{"pid":2720,"ppid":2888,"name":"cmd.exe","command_line":"\"/c md c:\\newpr","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018357-00002720","icon":"$31"},{"pid":2724,"ppid":2888,"name":"cmd.exe","command_line":"\"/c md c:\\newpr\\ImgLib","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018364-00002724","icon":"$32"},{"pid":2808,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\ImgLib\\*.* c:\\newpr\\ImgLib","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018486-00002808","icon":"$33"},{"pid":2844,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\SetUp_chs.ini c:\\newpr\\SetUpCHS.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018491-00002844","icon":"$34"},{"pid":3088,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\SetUp_cht.ini c:\\newpr\\SetUpCHT.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018496-00003088","icon":"$35"},{"pid":2980,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\SetUp_eng.ini c:\\newpr\\SetUpENG.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018501-00002980","icon":"$36"},{"pid":3004,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\SetUp_other.ini c:\\newpr\\SetUpJPN.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018506-00003004","icon":"$37"},{"pid":3080,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Info\\Info_Sche.txt c:\\newpr\\Info_Sche.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018512-00003080","icon":"$38"},{"pid":2964,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Info\\Info_TChe.txt c:\\newpr\\Info_TChe.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018517-00002964","icon":"$39"},{"pid":3124,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Info\\Info_En.txt c:\\newpr\\Info_En.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018522-00003124","icon":"$3a"},{"pid":3200,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Info\\Info_Other.txt c:\\newpr\\Info_Other.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018528-00003200","icon":"$3b"},{"pid":3160,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Lang_chs.ini c:\\newpr\\laserwork\\Lang_chs.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018538-00003160","icon":"$3c"},{"pid":3184,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Lang_cht.ini c:\\newpr\\laserwork\\Lang_cht.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018544-00003184","icon":"$3d"},{"pid":3204,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Lang_eng.ini c:\\newpr\\laserwork\\Lang_eng.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018550-00003204","icon":"$3e"},{"pid":3324,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Lang_other.ini c:\\newpr\\laserwork\\Lang_other.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018556-00003324","icon":"$3f"},{"pid":3268,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Plug_chs.ini c:\\newpr\\rdplug\\Lang_chs.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018562-00003268","icon":"$40"},{"pid":3328,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Plug_cht.ini c:\\newpr\\rdplug\\Lang_cht.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018568-00003328","icon":"$41"},{"pid":3340,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Plug_eng.ini c:\\newpr\\rdplug\\Lang_eng.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018575-00003340","icon":"$42"},{"pid":3356,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Plug_other.ini c:\\newpr\\rdplug\\Lang_other.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018636-00003356","icon":"$43"},{"pid":3380,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Preview_chs.ini c:\\newpr\\com\\Preview_chs.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018656-00003380","icon":"$44"},{"pid":3408,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Preview_cht.ini c:\\newpr\\com\\Preview_cht.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018664-00003408","icon":"$45"},{"pid":3436,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Preview_eng.ini c:\\newpr\\com\\Preview_eng.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018672-00003436","icon":"$46"},{"pid":3448,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\Preview_other.ini c:\\newpr\\com\\Preview_other.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018684-00003448","icon":"$47"},{"pid":3476,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\LGP_chs.ini c:\\newpr\\com\\LGP_chs.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018693-00003476","icon":"$48"},{"pid":352,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newpr\\com\\LGP_cht.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018701-00000352","icon":"$49"},{"pid":3536,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\LGP_eng.ini c:\\newpr\\com\\LGP_eng.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018710-00003536","icon":"$4a"},{"pid":2692,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\LGP_other.ini c:\\newpr\\com\\LGP_other.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018718-00002692","icon":"$4b"},{"pid":272,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\config c:\\newpr\\laserwork\\config","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018725-00000272","icon":"$4c"},{"pid":3032,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\Plug_config c:\\newpr\\rdplug\\config","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018733-00003032","icon":"$4d"},{"pid":3024,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\Soft.ini c:\\newpr\\laserwork\\Soft.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018740-00003024","icon":"$4e"},{"pid":2848,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\Soft.ini c:\\newpr\\rdplug\\Soft.ini","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018748-00002848","icon":"$4f"},{"pid":3056,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\tips c:\\newpr\\com\\tips","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018761-00003056","icon":"$50"},{"pid":3620,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy CFG\\Param.lib c:\\newpr\\Param.lib","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018769-00003620","icon":"$51"},{"pid":3628,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Res\\Logo.ico c:\\newpr\\Logo.ico","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018784-00003628","icon":"$52"},{"pid":3660,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Res\\Splash.bmp c:\\newpr\\Splash.bmp","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018795-00003660","icon":"$53"},{"pid":3700,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Res\\RLD.ico c:\\newpr\\RLD.ico","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018805-00003700","icon":"$54"},{"pid":3624,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy RDMgr.dll c:\\newpr\\com\\RDMgr.dll","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018814-00003624","icon":"$55"},{"pid":3704,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\help.chm c:\\newpr\\laserwork\\help.chm","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018824-00003704","icon":"$56"},{"pid":596,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\help1.chm c:\\newpr\\laserwork\\help1.chm","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018834-00000596","icon":"$57"},{"pid":468,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\help2.chm c:\\newpr\\laserwork\\help2.chm","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018844-00000468","icon":"$58"},{"pid":1780,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\help3.chm c:\\newpr\\laserwork\\help3.chm","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018853-00001780","icon":"$59"},{"pid":1208,"ppid":2888,"name":"cmd.exe","command_line":"\"/c copy Lang\\help4.chm c:\\newpr\\laserwork\\help4.chm","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014569-00002888","uid":"00018883-00001208","icon":"$5a"},{"pid":3804,"ppid":2888,"name":"RDWorksSetUpV8.exe","command_line":"","sha256":"d21c8d388c64d602571118ca2afc0cad72c7ba8100bbb9d644655a54c045b0b4","normalized_path":"C:\\newpr\\RDWorksSetUpV8.exe","parent_uid":"00014569-00002888","uid":"00018892-00003804"}],"all_imported_dlls":["oleaccrc.dll","ntmarta.dll","PathMgr.dll","cfgmgr32.dll","gdi32.dll","sechost.dll","uxtheme.dll","devrtl.dll","slc.dll","user32.dll","oleaut32.dll","ole32.dll","comctl32.dll","psapi.dll","oleacc.dll","sfc_os.dll","mfc42.dll","winmm.dll","imm32.dll","dwmapi.dll","crypt32.dll","sfc.dll","winbrand.dll","AcGenral.dll","apphelp.dll","KernelBase.dll","msvcrt.dll","rpcrt4.dll","cryptbase.dll","msasn1.dll","sspicli.dll","mpr.dll","ieframe.dll","odbcint.dll","linkinfo.dll","ntdll.dll","rpcss.dll","wininet.dll","setupapi.dll","cabinet.dll","msctf.dll","urlmon.dll","samcli.dll","userenv.dll","srvcli.dll","msftedit.dll","devobj.dll","odbc32.dll","version.dll","ntshrui.dll","kernel32.dll","lpk.dll","usp10.dll","shlwapi.dll","imageres.dll","msacm32.dll","advapi32.dll","clbcatq.dll","shell32.dll","propsys.dll","Wldap32.dll","profapi.dll","cscapi.dll","iertutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ExCurve.dll","sha256":"adc4356ccac2de96325d08e297a9c2e94c6ed23caf975e5bc3fafe2c4c1b3b3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExLoader.dll","sha256":"233c53a316070070f084e5fbf4822105725dab24d7fb1b443641db068f7678d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ParaMgr.dll","sha256":"d6e585eada3a6712e275b2f80c9fe9618122fc230d60d0d7ca229e490b2cb633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDElement.dll","sha256":"4c27c381a026e43f6a5dd6c1b7b4a54e654c4f1340adc04d3c69f75a3e303fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDLGP.dll","sha256":"7fa7f8dfd1e89cde67e8a6bc2b9a88539d7cd61d355d4f8c2a39b9525f067102","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDMgr.dll","sha256":"5c7dab16f3480ff7da42f71adbe7e4aaf95213c12872b06f88387a686e70ae77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDReader.dll","sha256":"a0a021ffa56a12ee399f61459c8064d58589f08f034751229683236f26fc4f25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDWorksSetUpV8.exe","sha256":"d21c8d388c64d602571118ca2afc0cad72c7ba8100bbb9d644655a54c045b0b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"MFCO42D.dll","sha256":"c24f04b2bdcd9211e49853ec874c6d5c1bc6487b09c378d185aa37cceea5c4c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"MSVCRTD.dll","sha256":"db39f55c12069c366e4d1ce73dc42fb76cd5587468182048cc11ecfedd518b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RLD.dll","sha256":"73098ff95a5c69f21ef2144e676fa45336fd71b14c51f0cff28f9739e440c9d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"UnInst32.exe","sha256":"9f6311c613e5e739a0c945f76d370ff7468baee7af0673b240fa4ce3fa20d69f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"UnInst64.exe","sha256":"9f6311c613e5e739a0c945f76d370ff7468baee7af0673b240fa4ce3fa20d69f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftdibus.cat","sha256":"c60f69484dfb97d81b5814f5b25844b892d5f0f20d7fe71c11fb9b3dd6bd8bfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftdiport.cat","sha256":"036e53ac494a2d8e6c69b510f96e9446e910c96f64bbbe8eb60b6a226ef03838","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftcserco.dll","sha256":"94c3b96bdc73610cd926353c97b0918ec9515f7da64f57f15240d3966a5c2d38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"rdloadV8.dll","sha256":"99d4c84d84d215ddfa860f957d26cafe4a50107e665e6bd4f41afab5fbe84310","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDWorksV8.lnk","sha256":"26f594f98b6c170ad4aac1a05d019b77a75e094c1724c29cef6f82d098572f29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDWorksV8Uninstall.lnk","sha256":"3685e8c5b3dfa78f696c4846c49c795b186b0b4f591531a3f7f0eb0eb13e9214","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"2.tmp","sha256":"a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"temp_0.tmp","sha256":"43e27f18ef0a5c9f3ba3c00ae8768b493a8be52d90b313c7af074b3ff39cf07a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDCutting.dll","sha256":"61a7ffac928ffa20d489a6f86365f163dc3a11a0b22bcfe8f26670578191ffaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"EditCurveDLL.dll","sha256":"d76d8a257daa12c0baff29e28355cc6508bed9686084c620fc591c359e41c38b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Element.dll","sha256":"b7dc5851963a92bc8fdf9782374485373352163b3ca2a8c588dbb8ffba78c7cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExDib.dll","sha256":"284fb366087bf75da72da88691ce90d45a1eb64f571f13a5dd901e89ae49e9ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExDraw.dll","sha256":"6e7fd71849bbab7db02878cd0cff1a5fda9aa298eb5063a8846b50f73307d71f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExFileMgr.dll","sha256":"f411e3f26ecfdae59f2e68eb3dd74fcc47777628f02654b4a8881b8fc3d8e646","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExMath.dll","sha256":"67ace449806f1181c775f2fdbc3226b08218a0ce98d8225b4174536ebc21bd4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ExText.dll","sha256":"c9c8c37bdfb51eec009bd632a58d289c31a880284e9fec8f78913620546d333d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"FTD2XX.dll","sha256":"52173afbb38c95fb0e8f74e727bf353e470a05706c44a0807bad15aee95b9631","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"BIG.SHX","sha256":"383e786d8f584cb4ad2983d40e1377d13f99a7f3389823907ff02eb03431c39e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"COMPLEX.SHX","sha256":"0870bd5405df10c2d875dc4039d9b012f8e8bce40a1d49161873b7e6c04ee905","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"CYRILLIC.SHX","sha256":"02a1c8cd4700da7c3514c7ddf3859b73378e10dbb771f0bde80d7bf763506c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"CYRILTLC.SHX","sha256":"7aafb332ab462c567f9261d193e95118584eb381baacf4eec0c5a88eb40227a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"GOTHICE.SHX","sha256":"cc847c38999ffe671fc691c91f738668ef8ecaa27035bea6694a6937cf8e9303","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"MFC42D.dll","sha256":"3a3fa253ce80cf55027abc7918f8984057a94d1832302fb9893402aba9d35dff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"PathMgr.dll","sha256":"2a612866341fc58d89359af7345f427fbf4b785f2852bced112c5f5090c7be7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDCAM.dll","sha256":"47c35eb99f7bbc39c00a7ab08636f62d470d305ace7679e4eac61a31aaf1f61d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDWorksV8.exe","sha256":"6c3551848c83b880bb5fce73fc3570ba54798fa94b4a2c3250444cb379891b37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDWorksV8Uninstall.exe","sha256":"4bbcf613b489b5e73579e22c36add98f4410d6ffbad0f1b4aa8e355b227c9301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RdPasswordSet.dll","sha256":"d02c0ff0b0a3c7825556a35a7e5d55ed5a311f99a5c4550c85a69ad6d9405df0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"RDViewDLL.dll","sha256":"38295acb40e734c0e20776f5f546df922f65ca53ead9428a946f2c3000d7bf56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"rdloadV5.dll","sha256":"b63bae193a3d91a416483c9e3c06523500ab332e67431dc6c70d43c457e67633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"DPInst32.exe","sha256":"fefc6f5992a1896e40f5a9dcabc38a172ab88ce156f95201d59be2f7524c9b96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"DPInst64.exe","sha256":"3e3dd480aca5746113d3ad482393095d1ad3f96dd57262d0e637419e3ab19030","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftd2xx64.dll","sha256":"0a776a6191c81d3682bb8d6784b45faea858a3dbfbe4e1345386068e02fb7d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftdibus.inf","sha256":"fe9a14ca08865506207d1458d9948801d88720dd1a4e8d02e65ec92d12e890fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftdiport.inf","sha256":"dd6d037222813e2fc878ce9b3d7197a864201072c01622d9cbf5b8463cd6a05e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftbusui.dll","sha256":"72777139f330a2e7653c0b5d427b57172275edd4535c5f743bb0ade50037a0f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftd2xx.dll","sha256":"751258bb040197c7c10683a74b38a1b1aef9c68ca9a58ce2168c8a62cb913371","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftlang.dll","sha256":"1d0f04c67da0c6e62c236d90123cbb2e89709f1e960f24ed0ba07fa691f47f99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"ftserui2.dll","sha256":"278c9a9a7b0167507f750d67d278ac77d98fe06873e250bede9ae4177c69e8b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"drIptBdrFe.dll","sha256":"4a52bd1d9f13c39cf05bd1ad49ff953642d5c3b6bc7fef7c403888b9990802e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%TEMP%\\$inst","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%TEMP%\\$inst\\2.tmp","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%TEMP%\\$inst\\9.tmp","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"c:\\newpr","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"c:\\newpr\\ImgLib","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\driver","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\driver\\amd64","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\driver\\i386","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\laserwork","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\rdplug","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AI","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\autocad\\template","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\txt.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\Fs.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\gbcbig.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\HT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\Hztxt.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\template\\Khz.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\coreldraw","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\coreldraw\\64","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\cadian","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\wg\\AutoCAD\\64","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\SetUpENG.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RDWorksV8","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\RDWorksV8.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Help.chm","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Help1.chm","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDWorksV8Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDWorksV8.exe.manifest","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDWorksV8.exe.manifest","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\FTD2XX.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\FTD2XX.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDCAM.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDCAM.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\rld.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\rld.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExFileMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExFileMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDReader.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDReader.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDViewDll.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDViewDll.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\PathMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\PathMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExDraw.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExDraw.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExMath.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExMath.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExDib.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExDib.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExText.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExText.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExCurve.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExCurve.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ExLoader.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ExLoader.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDLGP.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDLGP.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\tips","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\tips","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\Element.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\ParaMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\ParaMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\EditCurveDLL.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDElement.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDElement.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RdPasswordSet.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RdPasswordSet.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDMgr.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\MFC42D.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\MFC42D.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\MFCO42D.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\MFCO42D.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\MSVCRTD.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\MSVCRTD.DLL","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\Preview_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Preview_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\Preview_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Preview_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\Preview_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Preview_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\Preview_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Preview_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\LGP_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\LGP_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\LGP_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\LGP_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\LGP_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\LGP_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\LGP_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\LGP_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Splash.bmp","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Lang_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Lang_chs.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Lang_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Lang_cht.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Lang_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Lang_eng.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\Lang_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Lang_other.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\soft.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\soft.ini","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\LaserWork\\config","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Param.lib","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Logo.ico","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\RLD.ico","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RLD.ico","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Vendor","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Info_SChe.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Vendor\\Info_SChe.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Info_TChe.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Vendor\\Info_TChe.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Info_En.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Vendor\\Info_En.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\Info_Other.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Vendor\\Info_Other.txt","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\BIG.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\BIG.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\COMPLEX.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\COMPLEX.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\CYRILLIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\CYRILLIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\CYRILTLC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\CYRILTLC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\Fs.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\Fs.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\gbcbig.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\gbcbig.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\GOTHICE.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\GOTHICE.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\GOTHICG.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\GOTHICG.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\GOTHICI.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\GOTHICI.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\GREEKC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\GREEKC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\GREEKS.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\GREEKS.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\HT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\HT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\Hztxt.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\Hztxt.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ITALIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ITALIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ITALICC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ITALICC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ITALICT.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ITALICT.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\Khz.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\Khz.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\MONOSI.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\MONOSI.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\MONOTXT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\MONOTXT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\newhzk.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\newhzk.shx","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ROMANC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ROMANC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ROMAND.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ROMAND.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ROMANS.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ROMANS.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\ROMANT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\ROMANT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SCRIPTC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SCRIPTC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SCRIPTS.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SCRIPTS.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SIMPLEX.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SIMPLEX.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SYASTRO.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SYASTRO.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SYMAP.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SYMAP.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SYMATH.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SYMATH.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SYMETEO.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SYMETEO.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\SYMUSIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\SYMUSIC.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\fonts\\TXT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Fonts\\TXT.SHX","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%USERPROFILE%\\Desktop\\RDWorksV8.lnk","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\Logo.ico","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDWorksV8.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RDWorksV8\\RDWorksV8.lnk","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDWorksV8\\RDWorksV8Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RDWorksV8\\RDWorksV8Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\newpr\\com\\RDCutting.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"path":"C:\\RDCutting.dll","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d270647ca3e15e9f4a9f83"}]}]}},"report_ids":{"sandbox_job_ids":["59d270647ca3e15e9f4a9f83"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample cf3295ec4faa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cf3295ec4faa…. Malware family: Malware. Threat score 100/100. 1/30 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample cf3295ec4faa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cf3295ec4faa…. Malware family: Malware. Threat score 100/100. 1/30 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cf3295ec4faab36e389a3c043aa5ca8d08a23e3d26fd03cc2aa87b9c4d39a55a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample cf3295ec4faa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cf3295ec4faa…. Malware family: Malware. Threat score 100/100. 1/30 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]